Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

NSA Prism Relies Heavily On IT Contractors

NSA whistleblower Snowden likely enjoyed access to Prism program details as a contracted NSA IT administrator. Systems administrators remain an important link in your security chain.

How did a Booz Allen contractor get his hands on top secret details about National Security Agency (NSA) intelligence operations?

Edward J. Snowden, 29, leaked confidential information to Britain's Guardian about the so-called NSA Prism program that conducts surveillance of online communications to and from foreigners, and leaked data to The Washington Post about the NSA's access to U.S. phone call metadata. According to Glenn Greenwald, a Brazil-based American who reports on civil liberties issues for the Guardian, Snowden has provided him with "thousands" of documents, of which "dozens" are newsworthy.

The leaks have highlighted how the NSA relies on an army on consultants to help it sift through the massive quantities of data it collects. According to information released this year by the Office of the Director of National Intelligence, 1.2 million Americans hold top-secret clearances, and 38% of those clearances are held by private contractors.

As that suggests, a substantial amount of U.S. intelligence work is now handled by private contractors. Naval War College professor John Schindler, a former NSA counterintelligence officer, said that the-post Sept. 11 launch of massive data-gathering operations -- for counterterrorism purposes -- required a commensurate increase in the number of people tasked with keeping those classified-data systems running.

[ Learn what Prism shows about cloud security. Read NSA Dragnet Debacle: What It Means To IT. ]

"It's hard to think of a single thing the intelligence community can do on its own anymore without a contractor being involved in some way, from the most mundane of data crunching to the pointy end of the black ops side," Peter Singer, director of the Center for 21st Century Security and Intelligence at the Brookings Institution, told The Wall Street Journal.

But how did Snowden access the confidential information in the first place, which includes a top secret Foreign Intelligence Surveillance Court order? A former senior NSA official told the Post that only 30 or 40 people in the world would have had access to that data.

Government investigators are "working with the NSA and others around the intelligence community to understand exactly what information this individual had access to, and how that individual was able to take that information outside the community," a senior U.S. intelligence official told the Post.

The NSA would have determined which specific systems Snowden would have been able to access, according to contractors interviewed by the Journal.

Given Snowden's biography and job description -- serving as an "infrastructure analyst" employed by Booz Allen, but working at an NSA satellite office in Hawaii -- many security experts believe that he didn't just have top secret clearance, but served as an information security or IT administrator tasked with keeping confidential systems running.

That might explain Snowden's remarks to the Guardian that he had "full access to the rosters of everyone working at the NSA, the entire intelligence community and undercover assets all around the world, the locations of every station we have, what their missions are and so forth."

A former senior official at the NSA told the Post, however, that Snowden's access claims are overblown. "When he said he had access to every CIA station around the world, he's lying," he said.

Then again, someone had to be maintaining the computer networks and related systems for those stations; what if it was Snowden?

The data leak situation further suggests that NSA officials might not have known the extent to which either private contractors or IT administrators were privy to highly confidential information.

Of course, no system is 100% secure, because a rogue or malicious insider can always decide to leak stored data. To put that another way, the security of any IT system -- no matter how clandestine -- hinges on trusting one's system administrator.

"They can be a critical security gap because they see everything," Naval War College professor Schindler told the Times. "They're like code clerks were in the 20th century. If a smart systems administrator went rogue, you'd be in trouble."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
builder7
50%
50%
builder7,
User Rank: Apprentice
6/24/2013 | 3:11:09 AM
re: NSA Prism Relies Heavily On IT Contractors
So, if this is true that there are 1.1 million contractors then that means that this privatization initiative started in the 1980's 'to save money and make the government smaller' actually increased the governments size by 1.1 million, high-paid private contractors and the companies that rake in the profit. No wonder our government is going broke!
KawiMan
50%
50%
KawiMan,
User Rank: Apprentice
6/12/2013 | 5:59:50 PM
re: NSA Prism Relies Heavily On IT Contractors
Amen! As an IT professional for 30 years, I have no pity for employers that cut staff and outsource. Loyalty is a word of the past. Employers don't give it to their staff, so why should employers expect it from their staff? They won't get it because they don't give it.
majenkins
50%
50%
majenkins,
User Rank: Apprentice
6/11/2013 | 7:39:38 PM
re: NSA Prism Relies Heavily On IT Contractors
"It's hard to think of a single thing the intelligence community can do on its own anymore without a contractor being involved in some way, . . .

So what you are saying is that long before Jason Bourne jumped off of that yacht some contractor would have blown the whistle on the whole shebang.
2sense
50%
50%
2sense,
User Rank: Apprentice
6/11/2013 | 7:32:44 PM
re: NSA Prism Relies Heavily On IT Contractors
If you want loyalty, buy a dog.
proberts551
50%
50%
proberts551,
User Rank: Apprentice
6/11/2013 | 5:27:45 PM
re: NSA Prism Relies Heavily On IT Contractors
"1.2 million Americans holdtop-secret clearances, and 38% of those clearances are held by privatecontractors." Why should the Government not be the same as Corporate America?
I would like to see the percentage for contactors vs employed direct for I.T. people in Corporate America. I work as a contractor for a fortune 500 company, employed, love my job...but, . 90% are contractors because they got rid of the full time employees, and cut staff to the bone. I have heard from friends in the industry, that their fortune 500 companies did the same thing.
The jobs that seem to stay, are management positions, who are deciding what
"workers" get the axe. All are trying to save their own skin. I.T. struggles to function because of that very situation. Thus, my job was created and I work for the department to keep up production because I.T. cannot handle it. Even employees that have been employed for 20+ years are not safe....if they are workers. I know of data centers that closed, moved to India for warehousing and IT server services. It is all about Money folks, and human resources is just that. Not personnel. No longer are you safe doing a great job for an employer. There is no loyalty anywhere unless you know someone high up that can save you.
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.