IT at the CIA

neocon writes "The current issue of the CIA's Studies in Intelligence (unclassified edition, natch) has an article on the state of IT within the CIA, titled 'Failing to Keep Up With the Information Revolution', which looks at how the agency has fared in staying up to date both with information security needs and with promising new technologies."

Comments

Interesting recommendations

[TopShelf]

Looking at the recommendations, what seems to pop out is that there is more a need for information organization than new-fangled gee-whiz technotoys. Analyst websites available via intranet, and the ability to search and join together information from various analyst accounts seem to be the major needs.

Made for OSS..

[i_want_you_to_throw_]

One reason is that DI offices cannot easily get funding for new software packages. The funding required for the development and testing of such tools--typically, tens of thousands of dollars per year--is small in comparison to the CIA's total budget. But it is enormous in the context of the discretionary funds that an individual office has--let alone an individual analyst.

Another reason for open source. I'm the lone OSS outpost in my military operation and when the budget cuts came, the OSS got rolled out!

Previously it was tough as hell but I am bringing in more and more OSS packages all the time that give some great functionality like Post-Nuke, phpESP, etc.

Now I can damn near get away with murder because I am still bringing some great functionality in with no additional cost.

This mantra has sold Linux more than anything else: "Services, not platforms".

Repeat

Re:Made for OSS..

[StandardDeviant]

Yeah, as I was reading that article, I was struck by how handy something like a secure version of LiveJournal would be to an intelligence organization. Each analyst could post things up, works in progress, tidbits of interest, or formal product, which could then be syndicated by other analysts and consumers of analytic content in a fluid manner (NB: obviously would need some additional access, authentication, and authorization infrastructure to regulate who can syndicate what). Further, the LJ codebase would allow feedback on each entry in the analyst's "text stream", or I should say "media stream". And as a bonus, clients exist to talk to LJ servers from pretty much any platform, and most don't require any knowledge of HTML or similar technologies by the end user. The source code for the LJ server system as well as most of the clients is available here but as usual for any outside product, it'd probably be wise to commission a source review of it before putting it into production in a secure environment. (This may be one way to help fund the projects, if possible, by commissioning project developers to contribute to the security process, and allowing the non-agency-specific security changes to be rolled back into the public sphere, analogous to the NSA's SELinux.)

Re:firewall? we don't need no stinkin' firewall!

[SirWhoopass]

The US uses the same thing with SIPRNET. It is physically separate from the internet. Script kiddies like to gloat about how insecure military networks are and how they hacked into classified information. Not true. They may certainly have seen some "private" web sites with telephone or social security numbers, but not actual classified information. They'd need to dig a hole and splice fiber first.

It reads like a help desk...

[gamgee5273]

This is a similar tact, though not exact, to the help desk structures that are successful. The DI analyst's job sounds quite a bit like the job my staff has to handle, and many of the suggestions like the ones I am regularly making.

I would suggest they actually look at those models. ITIL (the IT Infrastructure Library, brought to you by the British government) is an excellent set of guidelines to start off with...

Then they can hire me. :)

I worked for the navy at the pentagon.

[Anonymous Coward]

THe two networks are completely separate. Most people had a classified, and unclassified machine at their desk, completely separate. Once a disk had gone into a classified machine, it could never be used in an unclassified machineagain(In theory) same for hard drives and memory, including printer memory.

TEh only time i have ever heard of the two networks being connected was a seinor chief plugged two lan cards into one computer, just messing around. Caught unholy hell for it, luckily he was the sharpest guy with the most experience in the office(Never fuck with a chief, they run EVERYTHING) and just got a verbal ass kicking, off the record. At least thats how i heard the story.

Re:I worked for the navy at the pentagon.

[out180]

I didn't work at the Pentagon but I was the lead IT on a ship and also an engineer (post-eaos) for the the NIPR/SIPR shipboard ISNS provider.

The CIA isn't the only government agency that is behind the times. Lets talk about intelligence handling with the Navy. It wasn't until 4 years ago that an official standard, project if you will, was implemented on a broad scale to handle the class/unclass infosys traffic. Now I'm not saying that it didn't exist, because it did exist, but what I am hitting on here is that the Navy, in this example, didn't provide a clear cut method for shipboard units to maintain data via a computer network. Now, the standards existed, but on a broad scale it was left up to specific commands to implement a computer system within the regulations for INFOSEC without outside assistance. So lets get into how it was done, pre-ISNS days.

Seaman Smuckitelle is tasked with providing a half-ass computer network on the ship. Since during that time the DS's were still in existance it wasn't a hard task but the real fun came when everyone started messing around with it. The only "allowed" system shipboard was unclass due to the obvious INFOSEC requirements of a class network and the serious lack of personal that could accomplish such a task unassisted. Now, DS2 Smuck creates this network and connects all the major spaces together, this is UNCLASS mind you. Now, as you can probably tell what ended up on that unclass network, yep... classified material. In a matter of a week you have chief's writing CASREPS on it (a classified message). Then, someone has a bright idea. From a distant corner of the Wardroom comes a voice that says, lets put all of our message traffic on it through the exchange server. There was much celebrating from the wardroom that night and thus the unclass, insecure, half-ass, non-INFOSEC compliant network now magically becomes a secret network.

This isn't to scare anyone, its just to further extend the point of being "behind the times". In the case of the CIA we should hope that the outdated IT problem is due to hardware and lack of funding. In the case of the Navy it was due to a lack of training and organized leadership. The foresight of a tight, well designed INFOSYS infrastructure wasn't clear until well past its need. Once it was clear, they tried to do something about it. Now as of 2 years ago, when I last touched it, the times were changing... but there was still alot to be learned. Example being when the Navy decided to formalize their shipboard INFOSYS structure they downsized the DS rating (the only rating in the Navy that specialized in Data Systems specifically) and crossed all of the new IT responsibility to the RM's, or Radiomen. Now, who do you think could handle this task better, a Data Systems specialist trained in the use, support, and troubleshooting of computer systems (despite the obvious age of these system), or a RM who's only purpose in life was to push paper and transmit radio traffic? Well, I'll tell you this... any advance the Navy made by bringing a standard cross-ship platform for INFOSYS into the works was further slowed by allowing inexperienced people take charge of it. My exact point is made very clear in the above post where a Chief, a leader mind you, hooked an unclass and a class network together on the same system. Why might you ask? Well the real fact is clear, people as a whole are very concerned about Information Security, the single induhvidual (yes Dilbert) doesn't think before they act. Could it be innocent, yes but the information that is classified is made such for a reason and the gross mishandling of that information leads to serious problems. Do I believe that SIPR is secure, sure in theory, but the people behind it are not.

Its the government, they never choose wisely until its too late and then they always find a way to muck it up in the long run. You know how many times I went onboard a ship to fix a downed Exchange server and they hadn't backed up in 2 months....

Re:What the CIA needs:

[RobertNotBob]

One of the things I remember most clearly from the morning of 9-11 is the face of a former head of the CIA. He was going from one media outlet to another preaching from the mountaintop that this attack came because of a policy change preventing the CIA from paying known criminals. I don't remember his name off the top of my head, however I do remember he was on every channel saying the exact same thing over and over.

So there were at least SOME people who recognized the need for Human Intelligence, but it unfortunately seems that they were run out of the organization rather than listened to.

CIA Humint - Sigint - Remote Sensing

[Wyatt Earp]

The CIA's problem isn't a lack of funding, a lack of agents in the field or a lack of IT.

The problem is that since 1980 it hasn't figured out anything in advance.

1983 Hezbollah attacks on France/US missed
1983 Marxist revolt in Granada missed
1989 Czech border reforms missed
1989 E. Germany fall missed
1990 Iraqi invasion of Kuwait missed
1991 Coup attempt in USSR missed
1992-94 Islamists in Somalia missed
1993 Bombing of WTC missed
1998 African Embassy bombings missed
1999 Attempt on DDG Sullivans missed
2000 Bombing of Cole missed
2001 WTC/Pentagon missed

Clancy has been a CIA supporter for a long-time even though they don't accomplish anything anymore.

I read the Hunt for Bin Laden which is about the Green Berets in Afghanistan which doesn't have anything nice to say about CIA either.

I just don't see how they are relavent anymore.

Re:CIA Humint - Sigint - Remote Sensing

[Jonny Ringo]

Of course its also easy to not think about how many of these things they miss on purpose. Its the easiest way for the CIA to get more funding.

Re:CIA Humint - Sigint - Remote Sensing

[the_rev_matt]

I understand that they can't broadcast their successes, but seriously, missing pretty fundamental things NOT perpetrated by a shady loose network of terrorists (like the fall of E Germany, Czech border reforms, Iraqi invasion of Kuwait (esp. considering he ASKED PERMISSION), Coup attempt in USSR, hell they missed the fall of the Soviet Union even though Gorbachev had been broadcasting it for YEARS).

recruiters told me this three years ago

[Anonymous Coward]

I went to a job fair and talked with the CIA recruiters. They told me that if I was interested in cutting edge I should stay away. They had hardware and software that was older than dirt and had no budget for anything new and no forceable change in budget status.

I had them send me the employment forms anyway...

I then went to a dot.bomb - iCAST.com -
I should have gone with the CIA::

questions on the form ( in addition to listing all relatives, frinnds, neighbors, aquaintences, relatives neighbors aquaintences etc.)

Do you have any issue with being relocated during your tenure with the CIA

Do you understand that once hired you will remain an employee for a minimum of three years

Do you understand that at any time you may be relocated to wherever we need your services

e-mail vs. formal message traffic

[KD7JZ]

I worked for a large 3 Letter Agency during the late 80's through the mid-90s and one large issue we had was the transition from formal message traffic to e-mail. The military/intel community for years had a network for sending formal message traffic. These were written messages with formal accountability. They could be used to order actions, dispatch personnel, transfer money. When e-mail came along it was a big challenge to figure out if that same accountability could be built into e-mail or not.

This is not limited to the CIA

[nemaispuke]

Before I retired from the Navy, I worked in an Intelligence facility at the Top Secret level. The equipment that was available to me was several Macs (to produce PowerPoint slides), a Sun Sparc 10 used as a file and print server, a terminal to connect to PROFS (IBM OfficeVision) to read Top Secret e-mail, another Mac to access the Secret LAN and read Secret e-mail. There were no unclassified PC's, Macs, or Unix workstations to "surf the net" despite reading an article in the same command about "open source intelligence". Part of the problem is compartmenting the information which makes it difficult to search for information since not everyone can access all the information based on the compartments an individual is cleared for. This will not go away soon. And let's not get into the politics of it.

Re:What the CIA needs:

[dolbywan_kenobi]

Qualifications: How about the raid on Son_Tay in Vietnam? Perfectly executed in everyway except there were no prisoners there. Or to use a more modern example - Iraq. How many WMD have been found there? None. So either someone's lying to the American people or the CIA's intello is faulty.

Here's an anecdote I read a long while back, near the end of the Cold-War:

NATO wanted to know the bore of the gun of a Soviet tank. There was one in East Germany. The US used satellites at a cost of millions of dollars. The British used someone to break into the facility to measure the bore. The cost was to replace the lock but the person who did it risked his life. The French took a Russian officer out to dinner, after having plied him with good food and lots of alcohol and just asked the him what the bore was.

A bad case of falling behindism?

[swb]

"Falling Behindism" is a term that I and my old boss created for the creeping paranoia that says, no matter how hard you're working at it, you're falling behind technologically and are not keeping up. The corallary is that you can't ever catch up and are doomed to obsolensence.

I think everyone largely suffered from this during the late 90s, when, if you weren't paying attention for a week, you got two full revs behind on your applications and missed an OS rev entirely.

The reality is usually more nuanced and perceptions of technological sophistication are very skewed by trends. Having an advanced widget doesn't prevent falling behindism if the buzz is about using anti-widgets instead.

I think it's also a problem to look at the state of technology across broad fields (OS, systems, networks, applications) and see yourself behind on all of them. It's a false standard, since it's nearly impossible to get any decent sized organization current on everything (or anything) -- and even if you could, you'd garner some risk due to new problems not yet discovered.

Re:firewall? we don't need no stinkin' firewall!

[kruczkowski]

Funny thing is that ILUVYOU was released on SIPERNET. Becouse the militray has the secure mentality most (of those that do have) anti virus software were out of date.

Did I mention that the systems run Windows?

Don't believe everything you hear

[Muttonhead]

Black Ops:

1. Downplay your capabilities.
2. Carry out a sophistacated op, like bombing yourself.
3. Blame somebody else.
4. Proclaim, "Oops, we goofed. Give us more money to fix the problem."
5. Get more money for computers, etc.

Example: Michael Hayden a year or two before 9/11/2001.

True? Who knows, but the moral of the story is don't believe everything you hear. It stands to reason that anything the CIA wants the public to know is made available for a reason. And likewise everything it doeosn't want people to know is not made available.

Re:What the CIA needs:

[garyrich]

"Or to use a more modern example - Iraq. How many WMD have been found there? None. So either someone's lying to the American people or the CIA's intello is faulty."

Actually the CIA had been telling the executive branch for a long time that Iraq didn't have any WMD, or at least not any significant weapons stockpile. They got so sick of hearing such "unpatriotic" talk in the white house that they stopped listening to the CIA a couple of years ago. Rumsfeld and Cheney run their own little "mini CIA" out of the DOD that tells them what they want to hear. CIA intel is largely ignored.

Could not disagree more strongly

[slashdotcassius]

For DI, to be breeched is to fail. As a phrase in the article adeptly hints, managing risk indicates, at best, incompetence, and at worst, treason. A policy of excluding risk, however, is acceptable. Where Bruce Berkowitz suggests, " . . . a 35-year-old DI analyst with ten years of experience ought to be able--routinely-- to take calls directly... noting where there is important uncertainty or disagreement", I could not disagree more strongly. Never should the opportunity for treasons of subterfuge of misdirection lie within a single human being. The current bureaucracy of peer review represents an excellent example of risk exclusion policy.