Mimicking in some ways BradleyManning, Edward Snowden was apparently able to smuggle classified documents from his work location using a thumb drive:
WASHINGTON — Former National Security Agency contract employee Edward Snowden used a computer thumb drive to smuggle highly classified documents out of an NSA facility in Hawaii, using a portable digital device supposedly barred inside the cyber spying agency, U.S. officials said.
Investigators “know how many documents he downloaded and what server he took them from,” said one official who would not be named while speaking about the ongoing investigation.
Snowden worked as a system administrator, a technical job that gave him wide access to NSA computer networks and presumably a keen understanding of how those networks are monitored for unauthorized downloads.
“Of course, there are always exceptions” to the thumb drive ban, a former NSA official said, particularly for network administrators. “There are people who need to use a thumb drive and they have special permission. But when you use one, people always look at you funny.”
(…)
Confirmation of a thumb drive solved one of the central mysteries in the case: how Snowden, who worked for contracting giant Booz Allen Hamilton, physically removed classified material from an spy agency famous for strict security and ultra-secrecy.
He acknowledged on Sunday that he gave two news organizations details of secret NSA surveillance programs on telephones and the Internet, but did not say how he had transferred the data. He is believed to be hiding in Hong Kong.
Officials said they still don’t know how Snowden got access to an order marked “Top Secret” from the Foreign Intelligence Surveillance Court, or a highly-classified directive from President Obama authorizing a military target list for cyber attacks. Neither document would be widely shared, or normally available to a low-level NSA employee.
Bradley Manning, of course, smuggled classified documents out of a secure Army location in Iraq using both thumb drives and either DYD-Rom’s or CD-Rom’s, and when that was revealed it caused many to wonder why there wasn’t more physical and software security on the terminals used to access classified data. While eliminating the ability to use either data storage method completely may not be possible, one would think that there ought to be a way to restrict its use, or monitor when someone was copying data to offline storage for no apparent reason. The fact that Snowden was apparently a Systems Analyst of some kind, of course, may have given him the ability to mask his copying activities, but that’s just pure speculation on my part. We require the people who work for the NSA and other agencies to take oaths regarding the proper use of classified data, but it seems to me that may be time to look at the computer systems themselves to try to ensure that it becomes much more difficult for them to do so.
