IT at the CIA

neocon writes "The current issue of the CIA's Studies in Intelligence (unclassified edition, natch) has an article on the state of IT within the CIA, titled 'Failing to Keep Up With the Information Revolution', which looks at how the agency has fared in staying up to date both with information security needs and with promising new technologies."

Comments

firewall? we don't need no stinkin' firewall!

[Black Copter Control]

A friend of mine was talking to an IT type at CSIS (Canadian Security and Intelligence Service -- equivalent to CIA). He asked them what kind of firewall they used for their secure systems.

"We don't use a firewall. We use an air gap."

Re:firewall? we don't need no stinkin' firewall!

[SirWhoopass]

The US uses the same thing with SIPRNET. It is physically separate from the internet. Script kiddies like to gloat about how insecure military networks are and how they hacked into classified information. Not true. They may certainly have seen some "private" web sites with telephone or social security numbers, but not actual classified information. They'd need to dig a hole and splice fiber first.

Made for OSS..

[i_want_you_to_throw_]

One reason is that DI offices cannot easily get funding for new software packages. The funding required for the development and testing of such tools--typically, tens of thousands of dollars per year--is small in comparison to the CIA's total budget. But it is enormous in the context of the discretionary funds that an individual office has--let alone an individual analyst.

Another reason for open source. I'm the lone OSS outpost in my military operation and when the budget cuts came, the OSS got rolled out!

Previously it was tough as hell but I am bringing in more and more OSS packages all the time that give some great functionality like Post-Nuke, phpESP, etc.

Now I can damn near get away with murder because I am still bringing some great functionality in with no additional cost.

This mantra has sold Linux more than anything else: "Services, not platforms".

Repeat

Re:Made for OSS..

[StandardDeviant]

Yeah, as I was reading that article, I was struck by how handy something like a secure version of LiveJournal would be to an intelligence organization. Each analyst could post things up, works in progress, tidbits of interest, or formal product, which could then be syndicated by other analysts and consumers of analytic content in a fluid manner (NB: obviously would need some additional access, authentication, and authorization infrastructure to regulate who can syndicate what). Further, the LJ codebase would allow feedback on each entry in the analyst's "text stream", or I should say "media stream". And as a bonus, clients exist to talk to LJ servers from pretty much any platform, and most don't require any knowledge of HTML or similar technologies by the end user. The source code for the LJ server system as well as most of the clients is available here but as usual for any outside product, it'd probably be wise to commission a source review of it before putting it into production in a secure environment. (This may be one way to help fund the projects, if possible, by commissioning project developers to contribute to the security process, and allowing the non-agency-specific security changes to be rolled back into the public sphere, analogous to the NSA's SELinux.)

Way off base

[mental_telepathy]

As far as I can tell, the author's main concern is that the CIA is not keeping up with the private sector due to security constraints. All I can say is, thank God. Any recent security poll will tell you that corporations have multiple security incidents per year, even if they take an active interest in security. Do we really want the CIA to publish a statement saying some script kiddie is publishing the names of suspected terrorists?

Re:What the CIA needs:

[tha_mink]

less technical assets, more people in the field.

And you're qualified to make that assessment how exactly?

I worked for the navy at the pentagon.

[Anonymous Coward]

THe two networks are completely separate. Most people had a classified, and unclassified machine at their desk, completely separate. Once a disk had gone into a classified machine, it could never be used in an unclassified machineagain(In theory) same for hard drives and memory, including printer memory.

TEh only time i have ever heard of the two networks being connected was a seinor chief plugged two lan cards into one computer, just messing around. Caught unholy hell for it, luckily he was the sharpest guy with the most experience in the office(Never fuck with a chief, they run EVERYTHING) and just got a verbal ass kicking, off the record. At least thats how i heard the story.

CIA Humint - Sigint - Remote Sensing

[Wyatt Earp]

The CIA's problem isn't a lack of funding, a lack of agents in the field or a lack of IT.

The problem is that since 1980 it hasn't figured out anything in advance.

1983 Hezbollah attacks on France/US missed
1983 Marxist revolt in Granada missed
1989 Czech border reforms missed
1989 E. Germany fall missed
1990 Iraqi invasion of Kuwait missed
1991 Coup attempt in USSR missed
1992-94 Islamists in Somalia missed
1993 Bombing of WTC missed
1998 African Embassy bombings missed
1999 Attempt on DDG Sullivans missed
2000 Bombing of Cole missed
2001 WTC/Pentagon missed

Clancy has been a CIA supporter for a long-time even though they don't accomplish anything anymore.

I read the Hunt for Bin Laden which is about the Green Berets in Afghanistan which doesn't have anything nice to say about CIA either.

I just don't see how they are relavent anymore.

Re:CIA Humint - Sigint - Remote Sensing

[fussman]

1983 Hezbollah attacks on France/US missed
1983 Marxist revolt in Granada missed
1989 Czech border reforms missed
1989 E. Germany fall missed
1990 Iraqi invasion of Kuwait missed
1991 Coup attempt in USSR missed
1992-94 Islamists in Somalia missed
1993 Bombing of WTC missed
1998 African Embassy bombings missed
1999 Attempt on DDG Sullivans missed
2000 Bombing of Cole missed
2001 WTC/Pentagon missed

Of course, it it always easier to look at the flaws of something rather that the strengths in the same area. How many things did they not 'miss' and actually have an unskilled civilian populace know about it?

Re:CIA Humint - Sigint - Remote Sensing

[stratjakt]

And what happened this memorial day weekend?

What happened at the millenium celebrations?

You can only compile a list of the misses, not hits. You have absolutely no idea what they've prevented.

recruiters told me this three years ago

[Anonymous Coward]

I went to a job fair and talked with the CIA recruiters. They told me that if I was interested in cutting edge I should stay away. They had hardware and software that was older than dirt and had no budget for anything new and no forceable change in budget status.

I had them send me the employment forms anyway...

I then went to a dot.bomb - iCAST.com -
I should have gone with the CIA::

questions on the form ( in addition to listing all relatives, frinnds, neighbors, aquaintences, relatives neighbors aquaintences etc.)

Do you have any issue with being relocated during your tenure with the CIA

Do you understand that once hired you will remain an employee for a minimum of three years

Do you understand that at any time you may be relocated to wherever we need your services

e-mail vs. formal message traffic

[KD7JZ]

I worked for a large 3 Letter Agency during the late 80's through the mid-90s and one large issue we had was the transition from formal message traffic to e-mail. The military/intel community for years had a network for sending formal message traffic. These were written messages with formal accountability. They could be used to order actions, dispatch personnel, transfer money. When e-mail came along it was a big challenge to figure out if that same accountability could be built into e-mail or not.

Not a fair accounting....

[DesScorp]

Like any govermnet agency, CIA is going to screw up from time to time. But even if they had everything they wanted, they STILL couldn't be omniscient.

Part of the problem is that CIA can't publicly talk about their successes much, for fear of jeapordizing personnel or methods. And even when they DO publicly make accurate predictions, often they're ignored.

The perfect example of this happened in 1983. The CIA released a report called "Terminal Giants". It was either ignored or written off as "Reagan-esque right wing propoganda" by the media and leftist politicians. The prediction of the report? That the USSR's economy was dying because of excessive military spending, and that the Soviet Union could collapse within ten years.

Nobody believed them. And to this day, CIA still doesn't get credit for that prediction.

This is not limited to the CIA

[nemaispuke]

Before I retired from the Navy, I worked in an Intelligence facility at the Top Secret level. The equipment that was available to me was several Macs (to produce PowerPoint slides), a Sun Sparc 10 used as a file and print server, a terminal to connect to PROFS (IBM OfficeVision) to read Top Secret e-mail, another Mac to access the Secret LAN and read Secret e-mail. There were no unclassified PC's, Macs, or Unix workstations to "surf the net" despite reading an article in the same command about "open source intelligence". Part of the problem is compartmenting the information which makes it difficult to search for information since not everyone can access all the information based on the compartments an individual is cleared for. This will not go away soon. And let's not get into the politics of it.