Vulnerabilities / Threats
6/11/2013
10:03 AM
Connect Directly
RSS
E-Mail
50%
50%

NSA Prism Relies Heavily On IT Contractors

NSA whistleblower Snowden likely enjoyed access to Prism program details as a contracted NSA IT administrator. Systems administrators remain an important link in your security chain.

How did a Booz Allen contractor get his hands on top secret details about National Security Agency (NSA) intelligence operations?

Edward J. Snowden, 29, leaked confidential information to Britain's Guardian about the so-called NSA Prism program that conducts surveillance of online communications to and from foreigners, and leaked data to The Washington Post about the NSA's access to U.S. phone call metadata. According to Glenn Greenwald, a Brazil-based American who reports on civil liberties issues for the Guardian, Snowden has provided him with "thousands" of documents, of which "dozens" are newsworthy.

The leaks have highlighted how the NSA relies on an army on consultants to help it sift through the massive quantities of data it collects. According to information released this year by the Office of the Director of National Intelligence, 1.2 million Americans hold top-secret clearances, and 38% of those clearances are held by private contractors.

As that suggests, a substantial amount of U.S. intelligence work is now handled by private contractors. Naval War College professor John Schindler, a former NSA counterintelligence officer, said that the-post Sept. 11 launch of massive data-gathering operations -- for counterterrorism purposes -- required a commensurate increase in the number of people tasked with keeping those classified-data systems running.

[ Learn what Prism shows about cloud security. Read NSA Dragnet Debacle: What It Means To IT. ]

"It's hard to think of a single thing the intelligence community can do on its own anymore without a contractor being involved in some way, from the most mundane of data crunching to the pointy end of the black ops side," Peter Singer, director of the Center for 21st Century Security and Intelligence at the Brookings Institution, told The Wall Street Journal.

But how did Snowden access the confidential information in the first place, which includes a top secret Foreign Intelligence Surveillance Court order? A former senior NSA official told the Post that only 30 or 40 people in the world would have had access to that data.

Government investigators are "working with the NSA and others around the intelligence community to understand exactly what information this individual had access to, and how that individual was able to take that information outside the community," a senior U.S. intelligence official told the Post.

The NSA would have determined which specific systems Snowden would have been able to access, according to contractors interviewed by the Journal.

Given Snowden's biography and job description -- serving as an "infrastructure analyst" employed by Booz Allen, but working at an NSA satellite office in Hawaii -- many security experts believe that he didn't just have top secret clearance, but served as an information security or IT administrator tasked with keeping confidential systems running.

That might explain Snowden's remarks to the Guardian that he had "full access to the rosters of everyone working at the NSA, the entire intelligence community and undercover assets all around the world, the locations of every station we have, what their missions are and so forth."

A former senior official at the NSA told the Post, however, that Snowden's access claims are overblown. "When he said he had access to every CIA station around the world, he's lying," he said.

Then again, someone had to be maintaining the computer networks and related systems for those stations; what if it was Snowden?

The data leak situation further suggests that NSA officials might not have known the extent to which either private contractors or IT administrators were privy to highly confidential information.

Of course, no system is 100% secure, because a rogue or malicious insider can always decide to leak stored data. To put that another way, the security of any IT system -- no matter how clandestine -- hinges on trusting one's system administrator.

"They can be a critical security gap because they see everything," Naval War College professor Schindler told the Times. "They're like code clerks were in the 20th century. If a smart systems administrator went rogue, you'd be in trouble."

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
proberts551
50%
50%
proberts551,
User Rank: Apprentice
6/11/2013 | 5:27:45 PM
re: NSA Prism Relies Heavily On IT Contractors
"1.2 million Americans holdtop-secret clearances, and 38% of those clearances are held by privatecontractors." Why should the Government not be the same as Corporate America?
I would like to see the percentage for contactors vs employed direct for I.T. people in Corporate America. I work as a contractor for a fortune 500 company, employed, love my job...but, . 90% are contractors because they got rid of the full time employees, and cut staff to the bone. I have heard from friends in the industry, that their fortune 500 companies did the same thing.
The jobs that seem to stay, are management positions, who are deciding what
"workers" get the axe. All are trying to save their own skin. I.T. struggles to function because of that very situation. Thus, my job was created and I work for the department to keep up production because I.T. cannot handle it. Even employees that have been employed for 20+ years are not safe....if they are workers. I know of data centers that closed, moved to India for warehousing and IT server services. It is all about Money folks, and human resources is just that. Not personnel. No longer are you safe doing a great job for an employer. There is no loyalty anywhere unless you know someone high up that can save you.
2sense
50%
50%
2sense,
User Rank: Apprentice
6/11/2013 | 7:32:44 PM
re: NSA Prism Relies Heavily On IT Contractors
If you want loyalty, buy a dog.
majenkins
50%
50%
majenkins,
User Rank: Apprentice
6/11/2013 | 7:39:38 PM
re: NSA Prism Relies Heavily On IT Contractors
"It's hard to think of a single thing the intelligence community can do on its own anymore without a contractor being involved in some way, . . .

So what you are saying is that long before Jason Bourne jumped off of that yacht some contractor would have blown the whistle on the whole shebang.
KawiMan
50%
50%
KawiMan,
User Rank: Apprentice
6/12/2013 | 5:59:50 PM
re: NSA Prism Relies Heavily On IT Contractors
Amen! As an IT professional for 30 years, I have no pity for employers that cut staff and outsource. Loyalty is a word of the past. Employers don't give it to their staff, so why should employers expect it from their staff? They won't get it because they don't give it.
builder7
50%
50%
builder7,
User Rank: Apprentice
6/24/2013 | 3:11:09 AM
re: NSA Prism Relies Heavily On IT Contractors
So, if this is true that there are 1.1 million contractors then that means that this privatization initiative started in the 1980's 'to save money and make the government smaller' actually increased the governments size by 1.1 million, high-paid private contractors and the companies that rake in the profit. No wonder our government is going broke!
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.