With Better Sharing of Intel Comes Danger

Hugh Pickens writes "Ellen Nakashima writes in the Washington Post that after the intelligence community came under heavy criticism after 9/11 for having failed to share data, officials sought to make it easier for various agencies to share sensitive information giving intelligence analysts wider access to government secrets but WikiLeaks has proved that there's a downside to better information-sharing. To prevent further breaches, the Pentagon has ordered that a feature that allows material to be copied onto thumb drives or other removable devices be disabled on its classified computer systems and will limit the number of classified systems from which material can be transferred to unclassified systems, as well as require that two people be involved in moving data from classified to unclassified systems. The bottom line is that recent leaks 'have blown a hole' in the framework by which governments guard their secrets. According to British journalist Simon Jenkins 'words on paper can be made secure, electronic archives not.'"

Comments

Leak DRM?

[markdavis]

>"To prevent further breaches, the Pentagon has ordered that a feature that allows material to be copied onto thumb drives or other removable devices be disabled on its classified computer systems"

Yeah, like that is really going to make THAT much of a difference. Oh- make sure to remove all printers too, prevent all Email/IRC/IM, cut and paste, CD/DVDRW, etc. I suppose I can't criticize them for trying, but no amount of stuff like that is going to prevent information leaks if someone wants to leak information. It is no different than DRM.

Re:Leak DRM?

[omni123]

It's not that it is impossible to leak information--that's never a goal--the idea is to increase the difficulty and risk to such a level that it is not worth it for the average employee to attempt to leak whatever mediocre information they have access to and that the employees the skill and access are more loyal and less likely to attempt it. In this way it is different to DRM because there is no inherent risk associated (for most people) as you are not going to lose your job or risk federal/military prison for your actions and thus there is nothing to dissuade you from attempting it.

For the record it is not particularly easy to use a printer to duplicate, say, 250,000 diplomatic cables and walk out with them under your arms. It's not particularly difficult to prevent the average employee from accessing IRC/IM either and the obvious risks attached to e-mail are far too high. The approaches do need to be more sophisticated.

Re:Leak DRM?

[ToasterMonkey]

Yeah, like that is really going to make THAT much of a difference. Oh- make sure to remove all printers too, prevent all Email/IRC/IM, cut and paste, CD/DVDRW, etc. I suppose I can't criticize them for trying, but no amount of stuff like that is going to prevent information leaks if someone wants to leak information. It is no different than DRM.

All printers on a secure network are also classified with big colored stickers on them. They may or may not log exactly who did what when on them. You decide.
BTW, everything else you said is entirely within the realm of possibility and/or already being done.

I suppose I can't criticize them for trying, but no amount of stuff like that is going to prevent information leaks if someone wants to leak information. It is no different than DRM.

At this level, "leaking" is no different than "spying"
You're pretty foolish to think nothing can be done about it. BTW, DRM works, this is why year old console games cost the same as new. PC games depreciate faster not because they are "old" because of piracy concerns. In fact, console games can maintain a steady price until the publisher decides to lower it, to promote a sequel for instance. No, entertainment shouldn't be free. You can buy a lap dance, but if you touch her tits, DRM will punch you in the face. It has a price, but she doesn't have take it just because you feel you deserve to do it.

How does that relate to technology? First, none of this discussion is a technology problem. They are all people problems, like most things. There isn't a mathematical proof for "secure" in the real world. That isn't the same thing as no security. Duh.

Re:Leak DRM?

[Anonymous Coward]

How are they going to block usb flash media? In the old days you could epoxy the usb ports and then just use ps/2 keyboard/mouse. But those are legacy now and you are forced to use USB on modern systems. Also, it's not exactly difficult to gain access to the usb headers to install unbroken ports.

I suppose you could write a filter driver to prevent access to removeable media... of course then all you have to do is make hardware that doesn't report itself as removeable.....
Alternately you could write a filter driver to only allow access to whitelisted volume guids, though that's pretty easy to workaround as well...

You're not going to achieve a technical solution.

As others have posted, two of the largest contributing factors to this are a) far too much data that should never be classified is, and the current system doesn't really allow you to unclassify the garbage, and b) use of of classified status to cover up illegal activity is or should be illegal, so it's only natural for people to blow the whistle in that case.

Re:Leak DRM?

[sumdumass]

Something I'm not sure you are giving enough credit for is that when they make it harder, it also makes it harder to not get caught.

Hopefully, they are not ignoring other avenues to get the information off the systems. If they are smart, they should be monitoring traffic more and attempts to bypass the restrictions put in place. The more complex it becomes to commit an act, the more complicated avoiding detection becomes. With this in place, it might make it easier to find people attempting to make the leaks.

Re:Leak DRM?

[Mogster]

For the record it is not particularly easy to use a printer to duplicate, say, 250,000 diplomatic cables and walk out with them under your arms.

True, however if said documents were already in deadtree format then all one needs is a camera.

And a microSD card is a lot less painfull than a roll of film... or so I would imagine ;-)

Re:Leak DRM?

[AK Marc]

I suppose you could write a filter driver to prevent access to removeable media... of course then all you have to do is make hardware that doesn't report itself as removeable.....

Then you code the OS such that any USB attached device which reports itself as non-removable doesn't get mounted and sends an email to the admin. It's USB. You write the USB drivers to not send anything out the USB port that isn't whether or not to turn on the CAPS light on the keyboard.

Re:Leak DRM?

[Doctor_Jest]

These sorts of restrictions are a daily part of any defense contractor's day (one who handles classified data/info.) The fact that the Pentagon and the government itself doesn't (until recently) hold itself to the same standards it holds its contractors is very telling.

It tells me they don't give a shit. So, let's take the DoD's clearances away until they can demonstrate good data handling of classified information. They do that to contractors they deem "incapable" of keeping secrets all the time. Time for their asses to taste the same medicine.

Re:Leak DRM?

[AJWM]

feature that allows material to be copied onto thumb drives or other removable devices be disabled on its classified computer systems

Here's a question: Why the hell was that stuff ever enabled in the first place?

A place I worked a while back -- we did QA for voting systems and for games -- was a lot more secure than that. Only one system on the LAN had a CD burner, and that was passworded and the media use logged. Cameras everywhere. Firing offense to have your own thumb drives (or to plug in a device like an MP3 player), etc. Cell phones forbidden without express authorization. Everything logged. Air-gap -- and you had to know the passwords, including to the cypherlock on the door -- on the machine that could access customers' code servers. Defeatable? Sure, but not without leaving a trail a mile wide. And this was on the voting side of the company, security on the gaming side was even tougher. (Hey, now we're talking about real money!)

Apparently the government doesn't take security as seriously as game software companies do.

Re:Leak DRM?

[Hognoxious]

Oh- make sure to remove all printers too, prevent all Email/IRC/IM, cut and paste, CD/DVDRW, etc.

Don't forget to confiscate everbody's crayons!

Re:Leak DRM?

[markdavis]

>You're pretty foolish to think nothing can be done about it.

You could, perhaps, protect a secret from being disclosed by 99.99% of people. But all it takes is one person and the secret is out. I never said they shouldn't try. Making it harder should be their goal.

>BTW, DRM works,

And you were calling ME foolish?

Re:Leak DRM?

[HangingChad]

the idea is to increase the difficulty and risk to such a level that it is not worth it for the average employee to attempt to leak whatever mediocre information they have access to

I can tell you from experience in government offices that adding any process raising the difficulty of getting to information, lowers productivity. Not a little, a lot.

Stovepiping data also prevents "connecting the dots" another frequent criticism of pre-9/11 handling of intelligence information. It's deja vu all over again.

Re:Leak DRM?

[SuricouRaven]

So they loosen restrictions to promote shareing, then there is a breach, so they tighten restrictions for security, but then inefficiency grows and connections are missed, so they loosen restrictions....

It reminds me of the cycle of child protection laws. Laws are found to be too restrictive, to the point where people are afraid to look at a child without a government background check, so protections are slowly loosened... then some school caretaker murders a girl, and overnight laws are passed that require anyone who might ever be involved with people under eighteen needs to go through a six-week screening process. Schools complain about the expense, voluntary organisations complain, youth centers threaten to close... and over time the restrictions are lessened. Then another case of a child being raped or killed hits the headlines, and it all starts over again.

Re:Leak DRM?

[SuricouRaven]

There's a way to do this on windows through active directory. Of course there is a hack to get around it as well. But, as this is a government matter, they can go for the low-tech high-cost solution: Just place the computers in security cages, with keys held only by the people tasked with their maintainance.

Re:Leak DRM?

[19thNervousBreakdown]

I love how you call them dumb for falling for the simplistic and easily defended against trick that you imagined them falling for.

Re:Leak DRM?

[vxice]

I always wondered why there isn't some kind of 'checkout' system. You have to request the item like you would from a library, it would be digital so infinite copies what ever, and a log of who has what checked out. Anyone who reads an inhumane amount of material over any period, accounting for the small amount of time to even browse all material you checkout, would throw a red flag. The cables are short but there is still no way this guy even read all 250k cables. Would limit the amount of exposure.

Re:Leak DRM?

[vxice]

It is almost trivial in its repetitiveness, what you suggest is that we are all just grinding along in this giant MMORPG we call life? What is the end game? If any?

Re:Leak DRM?

[MightyMartian]

There is no method of storage that is absolute proof against maliciousness. Since the dawn of civilization governments have had to deal with traitors and moles. The Wikileaks situation underlines, in general terms, that you can never trust anyone absolutely, that giving out a certain degree of access to state secrets is an act of trust that comes with the accompanying risk.

The chief difference between events like the Pentagon Papers and the latest Wikileaks trove and espionage is that in these cases the idea was to blow the lid off, not simply to deliver it to another state's information apparatus. But at the end of the day, whether the object is to embarrass your government, to profit by selling a foreign state, or you're actually a citizen of a foreign state, or whatever configuration it is, if you manage to get sufficient clearance to access these sorts of documents, whatever form they're recorded on, you'll get your chance. About the only thing electronic records change is the volume of data that can be leaked in a short period of time.

Re:Leak DRM?

[markdavis]

>"So, DRM works, and is quite effective."

For every example you listed, there are dozens of examples of DRM that is/has been broken or worked around (DVD, BluRay, games on many consoles, hundreds of computer games, WiFi, CD audio, many satellite, PDF, etc, etc- just search Slashdot). Plus, some of those listed are not really examples of DRM, just plain encryption- that is not what DRM is about. DRM is about trying to let people see/use data and yet not let them copy the data.

Conclusion- DRM works SOMETIMES, but not most of the time. It is a deterrent that can make copying more difficult and in the process often severely punishes legitimate users/owners.

Re:Leak DRM?

[hairyfeet]

Sure you can solve the USB problem with tech, hell you don't gotta even glue the suckers shut. Just use something like this which I'm sure the US Gov can afford to buy from the guy, and have it throw up a red flag when some accesses any PC with a non pre-approved USB device. That is the nice thing about USB, you can write USB HID to do just about anything you want. Just strip the USB HID drivers out for anything other than Keyboard/mouse and have it throw a shitfit if any non-approved device gets plugged in.

Remember folks, we aren't talking about James Bond 007 superspies here, we are talking flunkies. Hell you look at the history of spying during the Cold War and many if not most major spies were just low to mid level flunkies that managed to worm themselves into a position where they had easy access to sensitive data. If that data would have been harder to copy a good amount of that spying never would have happened. I think the bigger problem is you are talking massive orgs with ungodly amounts of crap classified that frankly should have never been, thus making it all, the stuff you need and the stuff you don't, all that much harder to protect. I remember reading somewhere that on average the US gov labels 330 million documents PER YEAR as classified. What is that, something like FIVE libraries of congress? Every single year?

In that situation trying to protect the really important stuff is simply impossible because it is trying to find a single needle in a needle factory. We need to have a stringent review system that tosses all the old classified crap that is no longer needing protection, as well as forces review on the low level crap to see if it is REALLY worth protecting and if not toss it. By "thinning the herd" so to speak one could get a lot smaller pile and put much better security around the pile and thus seriously cut down the risk of leaks. At 300 million plus the odds are you are just gonna cripple the workers from getting anything done because too much of what they need for their jobs will require flaming hoops. Sadly with as big a bloated elephant as the US Gov the odds of any real reform are probably zip. It is just too massive, too bloated, too much bullshit you gotta wade through. But at 330 million plus no wonder there are leaks all over the place, good luck even cataloging all that shit before the next mountain of classified crap comes along!

Re:Leak DRM?

[Fluffeh]

There is no endgame in just about every mmorpg. The game is paying the creator a monthly subscription.

In life we just live, pay taxes and there is no connecti...

Wait wut?!

Re:Leak DRM?

[RazorSharp]

Or just don't participate in corrupt activities. Whistleblowers almost always leak information because they feel morally obligated to do so (leaking information puts one's future and safety at risk, no one does it for kicks or b/c they hope to make money). Many whistleblowers (especially in the corporate world) fall victim to strange accidents or they find themselves blacklisted from employment. When people decide to leak information like this they've made a conscious decision that doing so is more important than their own life.

Whistleblowers aren't spies, they're just people with morals. If our government is concerned with protecting itself against the ethically conscious, then perhaps there's no hope. The government has become everything it was designed to prevent: a tyranny. The only reason I haven't reached this conclusion yet is b/c Obama has been so hands-off with this Wikileaks mess. It's been the usual band of psychos that have called for Assange's arrest/assassination: Lieberman, McConnell, ect.

Re:Leak DRM?

[Zerth]

You write the USB drivers to not send anything out the USB port that isn't whether or not to turn on the CAPS light on the keyboard.

Hrm... I've got this macro that blinks the caps light according to a text file and I've got this photodetector on a chip that stores the readings in a tiny amount of flash, only 128 megs, paltry amount.

Clearly, I could not break security with this.

Re:Leak DRM?

[markdavis]

Wouldn't it be easier to just use thin-client computing with encrypted sessions (where the thin client has no local storage and no mapping back of any ports)? I do it with Linux/X every day...

Re:Leak DRM?

[omni123]

It is not a perfect world and the reality is that "don't participate in corrupt activities" is extremely naive. The issue I have is that everyone has a different definition of corrupt activities and leaving it up to the individual to leak classified material on a whim is impracticable.

I don't know how you think that works. One very cautious person considers a highly classified mission to be immoral, and thus leaks details, which the majority considers acceptable. Vigilante justice rarely works.

Re:Leak DRM?

[evought]

The other problem is that this was already policy in the '90s when I worked in AFSAA in the Pentagon. You were not allowed to copy data to non-classified system without the approval of specific officers who were tasked to examine the data. The data was copied onto a zeroed disk in a clean system, examined directly and in a hex editor. Then, if approved, it was copied for you onto a disk marked unclassified. There were also strict rules about the use of pads of paper (remove the top sheet, put it on a hard surface, write your note; that way you did not leave stray impressions on the pad which might be distributed. In the vaults, they often had pads stamped "SECRET" or "TOP SECRET" to make this less likely.) And there were quite a few applications we used where cut and paste was disabled or limited.

This obviously slowed things down, but that was the whole point. There had been several incidents where people had bypassed the rules and classified data were nearly leaked (the affected unclassified systems had to be scrubbed). Even if you just know that a document contains no classified information, it is quite possible that a file does. Problems were specifically discovered with MS Word files where random data from the system could end up in non-visible portions of the file. Once on an Unclassified system, the classified data might end up in swap space or otherwise be copied to where it should not be and remain after the offending file was wiped. Therefore the entire contaminated system would usually be wiped and reinstalled from a clean image. And, often the offending person would have their career shortened considerably. We dealt with nuclear deployment data and WINTEL (data which could reveal the identity of intelligence sources), so courts martial was always a possibility even, perhaps especially, for inadvertent release.

Personally, I consider release of classified data through idiocy to be a higher offense than doing so on purpose through act-of-conscience. The procedures exist for a reason, and often it is not to make things convenient. Carelessness gets people killed.

About when I stopped doing work there (1997-98) was when they were really going gung ho on the "classified Internet" where classified networks were tunneled over the DoD Unclassified Internet. That made for a lot more mixing of systems and cables which, I think, made it much harder to enforce strict separation. It used to be that there had to be 6' between the Top Secret network cables and the Unclassified network cables (and the cables were color coded). Ostensibly that was to prevent electronic feedback from leaking signals, but I think the real reason was to make absolutely sure the wrong network cable never went to the wrong hub and that someone lost their job if it did. It was absolutely forbidden to patch a classified cable outside of the designated rooms and areas. Classified printers, copiers, and CD burners were usually in designated areas as well. (You were allowed to make Unclassified copies on a Classified copier as long as you ran three blank pages through first to clear any residual images on the drum; you were never allowed to copy Classified data on an Unclassified copier outside the designated areas). Trash, of course, was separated by classification level and classified electronic waste (e.g. bad hard drives) were destroyed. Some manufacturers insisted that we return bad drives for warranty replacement, which was fine, as long as they understood that the platters would be physically destroyed first.

In any case, I am not surprised at this rule as much as surprised that it was allowed to lapse. You cannot 100% prevent leaks of data, but you at least want to make sure it is deliberate, that people are aware of what they are doing and of what the consequences will be.

Re:Leak DRM?

[markdavis]

Had I not already posted (obviously), I would have marked your posting +1 Informative.

Re:Leak DRM?

[evought]

Actually, in some of the secure facilities I've worked in, the solution was simpler: use PS/2 keyboards and superglue the USB ports. Sometimes the low-tech solutions can be the most reliable. By the same token, make sure the only removable media are read-only optical drives (except for specific stations assigned for controlled copying of data). In quite a few places, MP3/minidisk players were simply not allowed. You could use portable CD-players or put music files on a CD and play them through a classified system. That depended on the facility, though.

The rapid growth of portable electronic devices people now carry is hell on security, unless you strip search workers going in and out. Even calculators and phones can copy enough sensitive stuff to get people killed. Now that Bluetooth has become popular, the devices don't even need to be physically attached to anything, unless that is also physically disabled on every workstation and laptop that gets deployed. As a contractor, I've had to check-in my own equipment at a lot of places, have it inspected and tagged on the way in and out. That included DoD work, obviously, but also, say, IBM and GSK worksites. Annoying as hell, but understandable from their side.

Re:Leak DRM?

[wvmarle]

Apparently the government doesn't take security as seriously as game software companies do.

What you describe I would expect the Pentagon to have in place already, indeed.

I think the difference is that your game company is highly motivated because if it goes wrong, the people in charge lose their jobs and the owners of the company lose their investment. There is potentially a lot of money at stake - current investment and future earnings, so there is a lot of motivation to get this right.

Now compare that to the Pentagon. They don't have that motivation. The worst risk for the people in charge there is to be demoted to a less important, yet still very well paid position. Far less at stake.

Re:Leak DRM?

[Antique Geekmeister]

I've seen this one. Unfortunately, the extrenal devices they wanted to use, such as their approved wireless keyboards and remote KVM's and other devices, were no longer made in PS/2 format.

Re:Leak DRM?

[azalin]

>You're pretty foolish to think nothing can be done about it.

You could, perhaps, protect a secret from being disclosed by 99.99% of people. But all it takes is one person and the secret is out.

And that is the reason I don't believe in large scale conspiracy theories. Apart from reason, better knowledge and questions like "why should I trust this nutcase".
Two persons can keep a secret - If one of them is dead.
The more people involved, the more likely stuff will leak out sooner or later.

Re:Leak DRM?

[azalin]

Why don't you just connect the mouse and keyboard inside the desktop case and lock it. External USB is rather easy to disconnect or to glue shut.
BTW I do like the idea of using the keyboard lights as a medium, but wouldn't that require a lot more local access than you should have anyway?

Re:Leak DRM?

[rapiddescent]

one amusing story was one place I worked thought it would be a good idea to distribute soft lined metal boxes to each office so that staff could deposit phones into the box (instead of leaving with security who were inundated with phones every morning). This was because there was a suspicion that staff's phones could be intercepted by evil-doers and install bugging software on them; if they were in the box, it would dampen the sound. Except, one small problem was that people who left the phones switched on and put them in the box where causing the boxes to heat up massively in it's own little faraday cage - especially as the phones upped their power to get a signal and where insulated inside the box!!

Re:Leak DRM?

[jimbolauski]

>"To prevent further breaches, the Pentagon has ordered that a feature that allows material to be copied onto thumb drives or other removable devices be disabled on its classified computer systems"

Yeah, like that is really going to make THAT much of a difference. Oh- make sure to remove all printers too, prevent all Email/IRC/IM, cut and paste, CD/DVDRW, etc. I suppose I can't criticize them for trying, but no amount of stuff like that is going to prevent information leaks if someone wants to leak information. It is no different than DRM.

Many of these techniques would work, If you are on a classified network then you cannot access an unclassified network with that computer, so email/IRC/IM would not work, as for CD/DVD RW, almost all classified computers do not have these, that is one of the reasons that CD and DVD drives with out writing capabilities are sold so making sure all do not or ones that do are disabled would be easy. Disabling ports works wonders, so no printers, external HDs, or any other unauthorized external media can be added to the computer. When printing classified from a network computer simply have the printers located in the security office, as those documents have to be taken into accountability anyway. Your point is still valid that at some point you have to trust your users but following these procedures will limit the bleeding. Stopping 100% of the leaks is impossible but stopping the average user from leaking these documents is possible. These measures would have stopped Manning from leaking all the classified information as he had the technical knowledge of my grandma.

Re:Leak DRM?

[TheRaven64]

Not sure about the Pentagon, but in the UK classified networks do have email. Internal email can contain pretty much anything, external email goes through filters. These scan for certain keywords and anything that looks like it might be classified. If they contain things that the scanner can't open, they are summarily rejected. They flag quite an irritating number of false positives, so I doubt that they let much through that they shouldn't. Anything that they flag is logged, and flagged emails may be investigated by a human - they will if you send a lot of them.

Re:Leak DRM?

[RingDev]

And Wikileaks has not published any highly classified mission material.

Heck, most of the stuff in the cables wasn't even classified! It was just tagged with "No internet distribution". And even the stuff that was sensitive/secret could have been obtained via a FOIA request.

This leak was entirely about promoting democracy, government accountability, and building a historical context for a point in time where we are engaged in two wars with active military operations in 4 or more countries.

It really isn't that big of deal.

-Rick

Re:Leak DRM?

[Anonymous Coward]

Why was that stuff enabled in the first place? Well, classified networks tend to be accessible only after several security checkpoints (granted you are not searched at many or any of them) in a building you get access to after months or years of background checks to scrutinize you and your need to get access to this data.

Unlike the users of voting machines, users of classified networks are trusted not to do harm. There is a difference between trusted and trustworthy so there is quite a bit more effort into detecting leaks instead of preventing them. Thinking back to those unmanned security gates, it would be very easy to see if security guards are posted at the time you want to go through with your USB drive. If security is there, turn around and leave the drive in your car. If they're not, go and abuse the honor system. Disabling or removing USB is only a small part in making it harder to leak classified information. How else would you copy the data? It's very easy to find a device has a camera and how do you protect against that? It's very difficult and the audit trail is equally if not much longer. Unlike your software company, the government (or at least another "Department of" agency) takes security a few extra steps further by having well armed security guards ready to shoot you at a moments notice if they notice a security threat.

The problem the DoD is facing (apart from it doing things the leakers morally oppose to) is that there are too many people with access to classified data at which point you no longer trust those people, you're just throwing away data security. Certainly compartmentalization help data security tremendously and the whole point of it is to decrease the size of the set of people who have access. Another thought on compartmentalization, if Pfc. Manning had such easy access to it you can bet the information in the embassy cables wasn't important enough to protect more, e.g why aren't cables classified higher than SECRET?

Re:Leak DRM?

[KingOfBLASH]

Name one whistleblower who met with a "strange accident"

Re:Leak DRM?

[Unordained]

There are plenty of layers at which that could be logged for later review, yeah. Filesystems have for a while now had auditing that includes each time a user reads a file. Databases can have that setup via stored procedures, etc. Web servers, or other app layers, can also do the logging. If you differentiate between "read subject line" and "read body", and distinguish between "ran a search that looked at the body" vs. "user saw the body himself", you could get a good starting point for writing what should be, truly, a simple report. Add to that mappings of documents to departments, departments to users, and you could even detect someone who was trying to very slowly siphon out documents that should be available to him, but shouldn't pertain to him on such a regular basis.

Re:Leak DRM?

[omni123]

I agree but we are talking about whistle blowing and the security of government intelligence in general (ala the helicopter video and any thing Assange says he has on his black book if he gets taken down) not just these cables.

Re:Leak DRM?

[RazorSharp]

http://www.abovetopsecret.com/forum/thread556388/pg1

http://www.dailymail.co.uk/news/article-488662/Iraq-whistleblower-Dr-Kelly-WAS-murdered-silence-says-MP.html

http://www.deccanherald.com/content/46616/whistleblower-rti-activist-satish-shetty.html

http://hollyonthehill.wordpress.com/2010/08/10/bp-whistleblower-found-dead/

Those are the first things Google brought up. I know I didn't provide any sources, the information in that post I learned while taking a Business Ethics class and I'm too lazy to dig out the text book and find examples.

Re:Leak DRM?

[StikyPad]

Yes, because games (and voting systems, to some extent) have an excellent track record for not being leaked. Please; go on.

Re:Leak DRM?

[StikyPad]

It was absolutely forbidden to patch a classified cable outside of the designated rooms and areas.

Which ignores the fact that it's absolutely trivial to patch into a network cable in the first place. Either the encryption wrapper is secure as it should be, in which case the transport mechanism is all but irrelevant, or else the data is vulnerable. That's why they stopped separating the data channels and started focusing on terminal area security instead.

Cryptography is the answer

[Anonymous Coward]

If things are done right, it can be made a true pain to get such documents off of government machines. Now whether the pentagon would be willing to be smart about this, I doubt.

Re:Cryptography is the answer

[Anonymous Coward]

No, you've just described what sounds like DRM.

The answer is policy, auditing, and the willingness to admit that spills will occur. Putting effort towards mitigating the effect of that spill and cleaning up the results would be a better use of resources than would trying to ensure no spill ever occurs.

Re:Cryptography is the answer

[arivanov]

That all _WAS_ there in the days when military systems ran on DGUX and Trusted Solaris. Things like not being cut-n-paste down data from a higher level security app into a lower level are just one of the basic features in both and are backed all the way to the OS level to ensure it is not easily bypassed.

It all WENT AWAY with the windows infestation of the networks. The military should not blame anyone but themselves here. Security levels and "colour" books were defined for a reason and no Windows system has ever managed to comply to them while connected to a network (NT had a C cert while disconnected and stripped of floppies and removable media).

As Gregg Lake used to sing: You get whatever Christmas you deserve and no knee jerk reaction can help against the fact that the system is no longer secure and no longer has a sufficient audit trail in the first place.

Headline total fail

[Anonymous Coward]

Come on, using a headline with Intel in it meaning something other than the company, on a geek site? Avoid the jargon and it becomes unambiguous: "With Better Sharing of Gov. Intelligence Comes Danger" (though using the words intelligence and government in the same sentence keeps making me do a double-take)

Re:Headline total fail

[aiht]

Sig: http: //www. chao ticking doms .com

Who is Chao, and why are they ticking doms?

My point being, ambiguous terms need context to specify what they're talking about.
The headline has no context until you read the article.

(Yes, I do know what your sig really says and yes, I do know that my misinterpretation is a bit of a stretch.)

Re:Headline total fail

[wvmarle]

When intelligence and government appear in the same sentence, the word "intelligence" still doesn't mean what you think it means. So they can just as well stick to "intel". Shorter words make better headlines.

For a good reason

[elewton]

Words on paper can be made secure because they're fucking worthless for replication and transfer.
They'd be even more secure if chipped into clay tablets in cuneiform.

Can't win for losing

[ColdWetDog]

What I don't understand is why a low level intelligence guy in a forward base in the middle of nowhere had access to diplomatic cables from say, China.

Information is traditionally doled out on a 'need to know' basis. Yes, the intelligence agencies got nailed for closeting information before 9/11 but surely the answer to that is not 'information wants to be free'.

Re:Can't win for losing

[hedwards]

Indeed. What they were having trouble with was having nobody in the agencies sharing information. I'm surprised that they weren't limiting access to specific individuals that are in charge of coordinating operations. And probably only showing it outside the agency. As in looky but no touchy unless it's determined to require more than a bit of looking.

Then from there the folks that are doing that can decide sort of who gets access within the department. Providing it to everybody in the agency is neither necessary nor wise.

As they say loose lips sink ships.

Re:Can't win for losing

[azalin]

And why is anyone able to access 250.000 items without raising a flag? If this would be about a dozen very revealing documents then it would be a mere oversight or someone being smart/lucky enough to get them out. But 250.000? Don't these systems have any log analyzers?

write access only

[sampas]

Actually, they're only disabling "write" capability on the thumb drives, so they'll still be able to get viruses from reading them. Didn't they learn anything from Buckshot Yankee? How about no flash drives or portable media? How about not bypassing controls? Although I do feel bad for the Pentagon. They've created a "secure" network with 3 million users. It takes just one schmuck to make it insecure.

Re:write access only

[Naturalis Philosopho]

That's the thing; I'm sure that there's way more than one leak in their dam. If wikileaks managed to get a hold of this information, why would anyone believe that every intelligence agency on the planet didn't already have all this information? I'm perplexed at the persecution that wikileaks has faced over this cable release as all they really did was expose the U.S. government's inability to keep classified information out of the hands of, well, anyone and everyone. I mean, the government would try to shift the focus away from their failure, but do people really not get that this info has probably been in the hands of every enemy we have for a good long time?

The system is broken. We can either fix it or try to blow smoke about the "terrorist organization" that let us all know how glaringly lax our security is. I guess now that our government is locking useful information away from every one who does need it, we know if they are concerned with keeping us safe or keeping themselves from being embarrassed.

Re:write access only

[sunderland56]

Write-access-only for USB devices could only be done via a software patch. So they are still vulnerable to:

• emailing
• ftp/etc
• burning a CD (like the current WikiLeaks was done)
• booting linux from a thumb drive and doing what you want

and I'm sure many more.

Last time I was at the Pentagon, all of their USB ports were physically disabled - either via breaking the socket with a pair of pliers, or by filling the socket with hot glue. What happened to that mandate?

Re:write access only

[sumdumass]

Last time I was at the Pentagon, all of their USB ports were physically disabled - either via breaking the socket with a pair of pliers, or by filling the socket with hot glue. What happened to that mandate?

Probably the insistence on the computer manufacturing industry and keyboard/mouse makers on not providing PS2 ports or equipment capable of using them. It's even getting hard to find printers that can be connected to a parallel port anymore.

Most likely what happened to that mandate has a lot to do with the government stopping the act of saying, this is what we need, who can provide it, and going with this is what is available, who can we buy from. Some of that saves money, some of it is payback for campaign contributions or slogans that got people elected. But I bet it all is somewhat unintended consequences.

Re:write access only

[detritus.]

I have a feeling that the machines on the classified network didn't have USB ports.
From what I've read, Pfc Manning went into the secure area and carried with him CD-RW's that when he checked in and out, had Lady Gaga and other artists written on them. The machines had a writable CD-ROM drives in them, and the people overseeing security apparently allowed soldiers to listen to music CD's on the drives, as access to the public internet wasn't possible from the classified network. He even said he lip-synced to artists making it appear to those around him he was merely listening to music to not raise suspicion, all the while he was pulling database files and writing them to the CD's. That's how he got them out of a secure area. To add insult to injury, the machines had removable hard drives that were wiped and re-imaged each time upon checking in and out, so the evidence of what was on these hard drives were lost when he left.

Re:write access only

[budgenator]

Where the system really fell apart was

Manning had social difficulties in the Army, which were attributed to the problems of being homosexual under the 'don't ask, don't tell' policy.[11] Before being arrested, Manning had been demoted from Specialist to Private First Class for assaulting another soldier and was scheduled to be discharged early.[5][13] Bradley Manning

an INTEL analyst who was demoted for assault and scheduled for an early discharge should have had his SIPRNET access terminated.

Re:write access only

[1729]

Last time I was at the Pentagon, all of their USB ports were physically disabled - either via breaking the socket with a pair of pliers, or by filling the socket with hot glue. What happened to that mandate?

USB is pretty essential. Macs, for example, have USB ports and maybe Firewire, but no PS/2 connector. If you want to connect a keyboard and mouse, you'll need USB. (Well, that or bluetooth, but security folks usually aren't keen on having radio transmitters in classified machines.)

Re:write access only

[Magada]

So... a classified system is used, but no logs of what use it has been put to remain? That's just unbelievable. I'd bet my bottom dollar security policies are better at WalMart.

Re:write access only

[Firethorn]

an INTEL analyst who was demoted for assault and scheduled for an early discharge should have had his SIPRNET access terminated.

Word. USAF he'd have had a hard time keeping his nipr(unclassified) access, much less sipr.

And so Wikileaks wins

[Homburg]

This is precisely the outcome that Wikileaks was looking for: Assange's plan has been to leak information in order to make those who wish to keep secrets paranoid, so that they clamp down on their own internal communications and become less effective:

The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive “secrecy tax”) and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption. Hence in a world where leaking is easy, secretive or unjust systems are nonlinearly hit relative to open, just systems. Since unjust systems, by their nature induce opponents, and in many places barely have the upper hand, mass leaking leaves them exquisitely vulnerable to those who seek to replace them with more open forms of governance.

Re:And so Wikileaks wins

[hedwards]

Might could be, but the reality is that those measures should have been in place before now. If that's his goal, he's done a real favor to the US government that now has to actually handle the materials responsibly. And without a whole lot of real secrets being revealed.

Sure this stuff was leaked to everybody, but for god's sake we've had Israeli intelligence looking through or stuff on the sly, just imagine what the enemy is managing to get.

Re:And so Wikileaks wins

[ZDRuX]

Wow, he told you all this? Not like you'd make assumptions about a man you've never met before or anything.

Re:And so Wikileaks wins

[hebertrich]

seek to replace them with more open forms of governance....
hmmm good idea .. maybe we should.
I was thinking of a new form of government where elected officials have no right to vote on laws , rules , etc .. but where the citizen , through the net , would be asked to vote on the projects. I guess im not the only one.

Thanks for mentioning it :) Thank you WikiLeaks ;)

Re:And so Wikileaks wins

[ToasterMonkey]

This is precisely the outcome that Wikileaks was looking for: Assange's plan has been to leak information in order to make those who wish to keep secrets paranoid, so that they clamp down on their own internal communications and become less effective:

The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive "secrecy tax") and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption. Hence in a world where leaking is easy, secretive or unjust systems are nonlinearly hit relative to open, just systems. Since unjust systems, by their nature induce opponents, and in many places barely have the upper hand, mass leaking leaves them exquisitely vulnerable to those who seek to replace them with more open forms of governance.

I'm sorry, but the next time someone pops the question about why so many hate Assange as opposed to Wikileaks, this is it. The man is crazy.
So steps will be taken to ensure secret information is even more tightly controlled, which is basically the goal in the first place, and "you win" ?
This is the definition of insanity, friends.

"The more secretive or unjust an organization is"
He is absolutely convinced that secrets are bad. Wake up folks, that isn't Gotham City out your window.

Re:And so Wikileaks wins

[Bootsy Collins]

This is precisely the outcome that Wikileaks was looking for: Assange's plan has been to leak information in order to make those who wish to keep secrets paranoid, so that they clamp down on their own internal communications and become less effective:

So the point is to make the United States' efforts to stop terrorist attacks less effective?

I know that's not what you're trying to say; it's not even what Assange is trying to say. But it's *one* of the effects of this process -- not the only one, I know, and people will argue that more good than harm has been done by these leaks. But it can't realistically be questioned that harm has been done. The question is essentially whether one believes that governments should ever keep secrets. The position of Assange, and most people here, appears to be "no, they shouldn't, ever." The kindest thing I can say about that position is that it's naive.

Re:And so Wikileaks wins

[cpt kangarooski]

So the point is to make the United States' efforts to stop terrorist attacks less effective?

I think it would be hard to make them less effective; they're pretty ineffective already. Some attacks proceeded anyway -- anthrax, the IRS guy -- some were stopped by civilians on the scene -- the fourth 9/11 plane, the shoe bomb -- and the ones that appear to have had the most government involvement are usually schmucks that never could have accomplished anything to begin with, and required help from the government to be even arguably a threat, and not just a joke.

The government clearly has no idea what it is, or should be, doing. The main thing that seems to be in our favor has been that no one with adequate resources who is competent enough to carry out an attack has wanted to do so. That or blind luck.

Re:And so Wikileaks wins

[Bootsy Collins]

So the point is to make the United States' efforts to stop terrorist attacks less effective?

I think it would be hard to make them less effective; they're pretty ineffective already.

How do you know that? I presume, since you're making this assertion, that you're cleared and have access to information most people do not on U.S. anti-terrorism operations? Or are you concluding that stuff you haven't heard about must therefore not exist?

Either way, the effectiveness (or lack thereof) of U.S. anti-terrorism operations had very little to do with the point I made in the post to which you replied.

Re:And so Wikileaks wins

[sumdumass]

Yes, I would like that too. The politicians just create the laws as needed and we can vote for them on the internet. And you can believe that I have enough zombie PCs out there that I can account for most all of not more of the apathetic population that just doesn't vote. I can finally have my Utopia..

Re:And so Wikileaks wins

[SuricouRaven]

It is in the best interests of all those anti-terrorism organisations to announce any success they have. Vocally. It justifies their future funding and expansion, and furthers the careers of those in charge. Sure enough, they do announce all the attacks they have prevented - but those are a rather unimpressive collection, like the shoe bomber. Why would they keep quiet about any successes they have, once they have enough evidence to make an arrest? (/disappear a suspect to a secret military tribunal)

Re:And so Wikileaks wins

[cpt kangarooski]

Or are you concluding that stuff you haven't heard about must therefore not exist?

This, chiefly. I am an American citizen. I have the right to judge how well the government that works for me is doing. And, since it only is legitimately empowered to govern if it has the consent of the governed, I have the right to grant or withdraw my consent as I see fit. All Americans have these rights.

I'm obviously not going to just trust them. The entire structure of the government is founded on distrust of power. If they keep secrets, then not only is it wholly appropriate to judge them on the basis of what information we do have, it is also fair to condemn them for keeping secrets.

Re:And so Wikileaks wins

[Serious Callers Only]

No, I think the point is to make oppressive organisations (including but not limited to the us spy agencies) retrench and not allow them to constantly expand. Either they are efficient and transparent or secretive and sclerotic. That's the argument anyway. I don't think it involves banning secrets, just restricting the number of them.

As to harm being done, get back to us when the country in question is not occupying two foreign countries, killing tens of thousands of civilians, running secret prisons, sending citizens to be tortured abroad, kidnapping civilians in peaceful countries, flouting the geneva convention, and collecting credit card details of foreign diplomats and visitors. Then perhaps we can talk about the harm releasing some diplomatic cables has done.

If the us gov had reacted sensibly, I think this release would actually show them in a good light compared to those they deal with, modulo some dirty tricks exposed. It does make me question just why the us spends so much money on patently unreliable allies from Pakistan to Saudi Arabia - allies who fund the very terrorists the us claims to be fighting - that is far more naive than assange's hopes.

Re:And so Wikileaks wins

[Bootsy Collins]

It is in the best interests of all those anti-terrorism organisations to announce any success they have. Vocally.

This is not true. While you're correct that announcing thwarted terrorist actions, and attributing those successes to your efforts, can have the effects you describe -- "justifies their future funding and expansion, and furthers the careers of those in charge" -- it can have other, bad, effects as well.

Re:And so Wikileaks wins

[ljw1004]

I think effectiveness of US anti-terrorist techniques is HARMED by its current levels of secrecy.

Think of the TSA and its no-fly list. And the fact that list itself is secret. And the fact that everything around it is shrouded in secrecy. It means that an ineffective and wasteful government program hsan't been exposed to the glare of public scrutiny that would have killed it. Likewise the body-scanners.

Think of government funding of people like funding Saddam or Noriega or Irangate-- public scrutiny could easily have squashed for their manifest stupidity, but in the culture of secrecy these counterproductive programs flourished.

I think that prosecuting the "war on terror" is like the other aspects of running a country: improved by the US's marvelous system of openness and checks and balances, and hindered when it follows the UK model of paternalistic secretive "we know best" government.

Re:And so Wikileaks wins

[Bootsy Collins]

This, chiefly. I am an American citizen. I have the right to judge how well the government that works for me is doing. And, since it only is legitimately empowered to govern if it has the consent of the governed, I have the right to grant or withdraw my consent as I see fit. All Americans have these rights.

I'm obviously not going to just trust them. The entire structure of the government is founded on distrust of power. If they keep secrets, then not only is it wholly appropriate to judge them on the basis of what information we do have, it is also fair to condemn them for keeping secrets.

I think it's perfectly sensible to say that you can only judge on the information you have. I think it's also important to consider the possibility that you may have incomplete information, particularly given that we're talking about organizations that we already know keep secrets. That doesn't require "just trusting them" -- not at all. I'm not suggesting a conclusion to draw -- I'm suggesting drawing no conclusion at all.

On the other hand, I think it's naive at best to "condemn (the government) for keeping secrets". I can understand being upset with the government about the keeping of some specific secret or secrets. But any secret? Believing that the government should never, ever keep secrets? That point-of-view seems unrealistic. You don't have to work hard to think of secrets the U.S. government has kept in the past where keeping those secrets was the right thing to do, and revealing them at the time could have been catastrophic.

Re:And so Wikileaks wins

[budgenator]

One point would be that they are trying to work their investigation up the organization's structure. Human nature controls most organizations and since the Roman Army it's been units of 11 men per firstline leader and 3 to 5 units per leader, so moving up just 2 rungs, reduces the effectivness of 90 to 150 people. Take off the head and the whole organization can fall apart.

Re:And so Wikileaks wins

[RazorSharp]

The kindest thing I can say about that position is that it's naive.

Just like in the movies:

ROOKIE COP: Don't we need a search warrant?

EXPERIENCE COP: Don't be naive, how could we do our job if we went around collecting search warrants for everyone? Are you saying we should just let this murdering bastard get away?

ROOKIE COP: Of course not.

EXPERIENCED COP: Yes, of course not. Ideals are wonderful when you're not the guy on the street dodging bullets. I know what's right and what's wrong, I don't need a judge's permission to uphold the law.

See the hypocrisy?

No, governments should not keep secrets. You may ask, then how does one conduct warfare without secrets? But I ask you, why should a government in this day and age be conducting warfare? The U.S. military hasn't defended the country from an invading army once in the last one hundred years, yet we've been at war multiple times. If the government wasn't able to keep secrets, we never would have invaded Iraq or Afghanistan in the first place.

I understand that there are small exceptions to this. When one is searching for a fugitive, it's best not to publish all the information the investigation has unfolded. But when that investigation is over there is no reason to keep the information secret. Files become declassified over time, but as of now there's no assurance that ALL files will become declassified over time. Classified status should not be given to a file for the sake of saving the government from embarrassment. We must err on the side of transparency rather than the side of security. There was a time in this country when "live free or die" was a common belief. Now people just want to live, and they'll sacrifice everything if you convince them doing so is necessary for their own survival.

If all classified material had a time-table for future release, then classified documents wouldn't contain dirty laundry.

Re:And so Wikileaks wins

[Eivind Eklund]

This, chiefly. I am an American citizen. I have the right to judge how well the government that works for me is doing. And, since it only is legitimately empowered to govern if it has the consent of the governed, I have the right to grant or withdraw my consent as I see fit. All Americans have these rights.

I'm obviously not going to just trust them. The entire structure of the government is founded on distrust of power. If they keep secrets, then not only is it wholly appropriate to judge them on the basis of what information we do have, it is also fair to condemn them for keeping secrets.

I think it's perfectly sensible to say that you can only judge on the information you have. I think it's also important to consider the possibility that you may have incomplete information, particularly given that we're talking about organizations that we already know keep secrets. That doesn't require "just trusting them" -- not at all. I'm not suggesting a conclusion to draw -- I'm suggesting drawing no conclusion at all.

That seems unreasonable if you're going to vote in an election influencing this.

Re:And so Wikileaks wins

[1729]

If all classified material had a time-table for future release, then classified documents wouldn't contain dirty laundry.

With few exceptions, classified documents do have such a timetable. See Section 3.3, "Automatic Declassification":

http://edocket.access.gpo.gov/2010/pdf/E9-31418.pdf

Classified status should not be given to a file for the sake of saving the government from embarrassment.

From the above-mentioned document:

Sec. 1.7. Classification Prohibitions and Limitations. (a) In no case shall
information be classified, continue to be maintained as classified, or fail
to be declassified in order to:
(1) conceal violations of law, inefficiency, or administrative error;
(2) prevent embarrassment to a person, organization, or agency;

Re:And so Wikileaks wins

[evought]

But it can't realistically be questioned that harm has been done. The question is essentially whether one believes that governments should ever keep secrets. The position of Assange, and most people here, appears to be "no, they shouldn't, ever." The kindest thing I can say about that position is that it's naive.

I think Assange's point is more that it is much easier to keep a small number of secrets than a large number and that this is incompatible with a manifestly unjust system. If that is his point, I would have to basically agree: you cannot use classification to cover up blatant crimes and violations of your own rules in a leaky intelligence environment. You cannot effectively control a global oppression network without secure communication. At some point the system needs to balance the costs of the two extremes and that is easier to do in a system which has some amount of integrity.

You also run into the problem that a system without integrity, which constantly violates its own rules, cannot use people's conscience as a means to keep secrecy. It is simply not terribly effective to tell someone that they really have to follow procedure because leaking will get a "good guy" killed when the good guys are blowing up children, targeting citizen responders, and trafficking in human slaves. Even if it is only a small percentage of "good guys" doing it, asking someone to cover it up immediately suggests that officials condone the crimes.

Now, if you keep your intelligence apparatus as trim as possible, work hard to weed out the immoral from rising to that level, follow your own rules consistently, don't classify your dinner receipts from the night before to hide them from the taxpayer, and visibly punish people who cross the line, it is a lot more effective when you say to someone "loose lips sink ships." They WANT to protect your secrets.

Is there a cost? You betcha, but there always is. That's just life. But on the balance, I would rather do right and be dead than do wrong and have to live with it.

Re:And so Wikileaks wins

[cpt kangarooski]

I'm not suggesting a conclusion to draw -- I'm suggesting drawing no conclusion at all.

In which case you could have a rogue government that did obvious evil things, claimed to do secret good things, and was not subject to whatever cures democracy could provide, since everyone would be paralyzed by the claims -- which might very well be false, in keeping with the known evils of the government -- of good.

That's not acceptable. This is the real world, and we are going to have to draw conclusions based upon what we've got. They might be wrong, but it's hardly our fault that we lack information that could justify the continued existence of the organizations that are keeping secrets from us. In fact, I'd say that wrong conclusions are their fault; they'd be better off not resorting to secrecy as much (it is pretty clearly abused now), and not keeping secrets for as long.

Believing that the government should never, ever keep secrets? That point-of-view seems unrealistic.

Oh, I don't think that it is realistic to expect a totally transparent government. OTOH, I do think that deviation from total transparency is at least not good, when justified, and usually bad, as it isn't. If we think of the goodwill a government might accumulate in the eyes of its citizens as the sum of the good and bad things it has done, secret good things don't count, and it's generally safe to assume, based on prior experience, that there are a lot of secret bad things, a value for which could be estimated. So secrecy really doesn't benefit the goodwill a government can have, and likely diminishes it. If it drops too low, the government will become illegitimate and need to be replaced.

So I see nothing wrong with condemning a government that keeps secrets from its people, and spitting upon the officials who engage in this. If they've done something wrong, and are cowering behind the claim of secrecy, they deserve it. And if they've done something good, but are tragically forced to conceal it, and are condemned nevertheless, the Super Chicken rule applies: They knew the job was dangerous when they took it.

Re:And so Wikileaks wins

[fishexe]

This is precisely the outcome that Wikileaks was looking for: Assange's plan has been to leak information in order to make those who wish to keep secrets paranoid, so that they clamp down on their own internal communications and become less effective:

The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive "secrecy tax") and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption. Hence in a world where leaking is easy, secretive or unjust systems are nonlinearly hit relative to open, just systems. Since unjust systems, by their nature induce opponents, and in many places barely have the upper hand, mass leaking leaves them exquisitely vulnerable to those who seek to replace them with more open forms of governance.

I'm sorry, but the next time someone pops the question about why so many hate Assange as opposed to Wikileaks, this is it. The man is crazy. So steps will be taken to ensure secret information is even more tightly controlled, which is basically the goal in the first place, and "you win" ?

I don't know how you got that from the above-quoted text. It seems pretty clear from the discussion of a nonlinear "secrecy tax" that there's an extra step: the steps that will be taken make it too expensive to keep all that many secrets, so less secrets are kept. Then the proponents of government transparency win.

Re:And so Wikileaks wins

[fishexe]

The question is essentially whether one believes that governments should ever keep secrets. The position of Assange, and most people here, appears to be "no, they shouldn't, ever." The kindest thing I can say about that position is that it's naive.

If that were their position, why would they redact anything at all?

Re:And so Wikileaks wins

[uninformedLuddite]

How do you know AC hasn't met him?

Re:And so Wikileaks wins

[Daedalon]

Wikileaks' target is unjust secretive material. They have been selective in their publishing and concentrated on revealing two-faced politics and outright corruption. Now that government is anticipating this kind of material to be leaked, they'll cramp down their effectiveness in handling this material.

If the officials decide to share unjustly secretive material in the same networks with justifiedly secret material, it's their call. Either unjustly secret material or effective sharing in one network.

As for security of the US of A, Wikileaks has likely only done to increase it. If one out of three million people have risked their life leaking to a non-profit oganization, rest assured that some others have leaked for profit and prosperity to competing, corrupt governments. Nobody knows if this has happened after 2001 Robert Hanssen and George Trofimoff cases or not, but now everyone knows it certainly was not just possible but easy.

Re:And so Wikileaks wins

[Daedalon]

Please excuse the karma whoring. Just noticed that Steven Aftergood of the Federation of American Scientists said the same in these words:

"A more discriminating approach to classifying information would yield a smaller volume of information requiring protection, making it easier to protect"

Re:And so Wikileaks wins

[Bootsy Collins]

I'm not suggesting a conclusion to draw -- I'm suggesting drawing no conclusion at all.

In which case you could have a rogue government that did obvious evil things, claimed to do secret good things, and was not subject to whatever cures democracy could provide, since everyone would be paralyzed by the claims -- which might very well be false, in keeping with the known evils of the government -- of good.

That doesn't follow at all. In the scenario you describe, my conclusion would be "I don't know the status of what, if anything, they're doing behind the scenes; but I know they're doing bad things right in front of my face. So the kindest thing I can say is that maybe, *maybe*, it's a wash. Time to go."

Believing that the government should never, ever keep secrets? That point-of-view seems unrealistic.

Oh, I don't think that it is realistic to expect a totally transparent government. OTOH, I do think that deviation from total transparency is at least not good, when justified, and usually bad, as it isn't.

If it's "justified", then by definition, how is it "not good"? That seems a contradiction.

So I see nothing wrong with condemning a government that keeps secrets from its people, and spitting upon the officials who engage in this. If they've done something wrong, and are cowering behind the claim of secrecy, they deserve it. And if they've done something good, but are tragically forced to conceal it, and are condemned nevertheless, the Super Chicken rule applies: They knew the job was dangerous when they took it.

I bolded the part to which I wanted to reply. Your statement here suggests that the only harm of considering all secret-keeping bad and applying the "cures democracy can provide" is to those who (as part of their jobs) keep secrets that'd you'd agree are justifiably kept secret if you were in the know. I'd argue that there's significantly more harm than just that -- that in fact, that's the least of the harms caused.

Re:And so Wikileaks wins

[Bootsy Collins]

The kindest thing I can say about that position is that it's naive.

Just like in the movies:

ROOKIE COP: Don't we need a search warrant?

EXPERIENCE COP: Don't be naive, how could we do our job if we went around collecting search warrants for everyone? Are you saying we should just let this murdering bastard get away?

ROOKIE COP: Of course not.

EXPERIENCED COP: Yes, of course not. Ideals are wonderful when you're not the guy on the street dodging bullets. I know what's right and what's wrong, I don't need a judge's permission to uphold the law.

See the hypocrisy?

No, sorry, I see an analogy that doesn't seem to me to be relevant instead. What am I missing? How does this relate?

No, governments should not keep secrets. You may ask, then how does one conduct warfare without secrets? But I ask you, why should a government in this day and age be conducting warfare? The U.S. military hasn't defended the country from an invading army once in the last one hundred years, yet we've been at war multiple times. If the government wasn't able to keep secrets, we never would have invaded Iraq or Afghanistan in the first place.

This example doesn't make much sense to me. Government secrecy did not hide a poor justification for the invasion of Iraq. There was a wealth of information in the public sphere that made it quite clear that the invasion of Iraq was both unjustified and a bad idea. We just failed, as a population, to consider it. The invasion of Iraq does indeed necessitate some finger-pointing; but most of that finger-pointing is at you and at me.

I understand that there are small exceptions to this. When one is searching for a fugitive, it's best not to publish all the information the investigation has unfolded. But when that investigation is over there is no reason to keep the information secret.

I'm not sure where this example is coming from, but it doesn't seem to apply. What are you talking about that isn't addressed by the Rules of Discovery?

Files become declassified over time, but as of now there's no assurance that ALL files will become declassified over time.

In the U.S., declassification is codified as required to occur within 25 years, unless certain narrowly-defined criteria apply.

Classified status should not be given to a file for the sake of saving the government from embarrassment.

I agree, and I think most other people do too -- which is why that's already illegal, in the U.S. anyway.

Re:And so Wikileaks wins

[Bootsy Collins]

The question is essentially whether one believes that governments should ever keep secrets. The position of Assange, and most people here, appears to be "no, they shouldn't, ever." The kindest thing I can say about that position is that it's naive.

If that were their position, why would they redact anything at all?

That's a fair point. But it's also interesting, because such redaction seems at odds with the 'statement of purpose' quoted above, to which I originally replied. There, Assange doesn't say that his intent is to inhibit the keeping of secrets that shouldn't be kept; he explicitly states his intent to inhibit the keeping of secrets *at all*.

Re:And so Wikileaks wins

[Bootsy Collins]

Wikileaks' target is unjust secretive material. They have been selective in their publishing and concentrated on revealing two-faced politics and outright corruption.

Putting aside for a moment the question of whether they have been as selective as you say -- as someone would argue that they haven't -- my point is that while you say their target is "unjust secretive material," Assange's public statement above indicates that his target is *all* secretive material -- that *all* keeping of secrets is bad.

Re:And so Wikileaks wins

[Bootsy Collins]

I think Assange's point is more that it is much easier to keep a small number of secrets than a large number and that this is incompatible with a manifestly unjust system.

I think that's a perfectly reasonable statement, from which most of the rest of what you wrote logically follows. However, I don't think your statement of Assange's point is consistent with the quote from him linked-to and cited above.

Re:And so Wikileaks wins

[cpt kangarooski]

That doesn't follow at all. In the scenario you describe, my conclusion would be

Weren't you all about not drawing conclusions at all?

If it's "justified", then by definition, how is it "not good"? That seems a contradiction.

Think of it in terms of 'least bad.' If you had a gangrenous arm, it might justifiably have to be cut off, but I'm sure you wouldn't view the benefits of losing an arm to be all that good, and wouldn't like to have a perfectly healthy arm taken away.

I bolded the part to which I wanted to reply. Your statement here suggests that the only harm of considering all secret-keeping bad and applying the "cures democracy can provide" is to those who (as part of their jobs) keep secrets that'd you'd agree are justifiably kept secret if you were in the know. I'd argue that there's significantly more harm than just that -- that in fact, that's the least of the harms caused.

No, all I said there was that if I condemned someone for keeping secrets, but that they had done so for the best, that that was a result they should have expected to happen with which they need to have already come to terms. I never said that that was the worst thing that could result from not keeping secrets at all, or from exposing secrets.

Re:And so Wikileaks wins

[fishexe]

That's a fair point. But it's also interesting, because such redaction seems at odds with the 'statement of purpose' quoted above, to which I originally replied. There, Assange doesn't say that his intent is to inhibit the keeping of secrets that shouldn't be kept; he explicitly states his intent to inhibit the keeping of secrets *at all*.

I'm not sure he "explicitly states" quite that. At least if you're going by what Homburg originally quoted, Assange explicitly states that he wants to impose a "secrecy tax" and that he wants to replace more secretive regimes with more open ones. It's a bit of a leap of logic to go from there to assuming he wants no secrets; I read it as "the secrecy tax should be large enough that governments only keep secret that which is essential to their mission, and no more." That seems to be in keeping with Wikileaks' behavior of both releasing documents and making redactions, and I find it to be a laudable position. Basically, fight the terrorists and keep the secrets needed to do so, but don't drag us into wars that you claim are fighting terrorists while really murdering innocent people, 'cause there's a tax on that.

Re:And so Wikileaks wins

[Agripa]

It's more of a guideline than executive order.

Re:And so Wikileaks wins

[1729]

It is an executive order! The entire classification system is defined by a series of executive orders, of which this is the most recent.

Re:And so Wikileaks wins

[Agripa]

Jack Sparrow: I thought you were supposed to keep to the code.
Mr. Gibbs: We figured they were more actual guidelines.

http://www.imdb.com/title/tt0325980/quotes

Re:And so Wikileaks wins

[BadDreamer]

Secretive and unjust communication does not stop terrorism. Arguably, it enables terrorism. Good police work stops terrorism. Therefore your premise is flawed; harm has been lessened, not done.

Re:And so Wikileaks wins

[evought]

Well, I just went through and reread the linked text and have read of some of his essays before. I am not entirely unsure that it might not be what he is trying to say; I just think he is saying it very poorly. A lot of people of that mindset couch their explanations in such pseudo-intellectual twaddle that it is hard to actually see the central point.

I admit I have not read his stuff in sufficient depth yet. I am just guessing that if I boil it long enough I'll end up with something like my summary plus some gooey and mostly uninteresting residue. But in any case, I think that what Wikileaks is doing could be justified by that logic, whether Assange is precisely doing it for that reason or not and even if a good bit of it actually comes down to self-aggrandizement.

This just in...

[AllWorkAndNoPlay]

Sharing secrets with more people MAY have a risk of more people knowing your secrets. Shocking.

Seriously though, adding a bunch of people/agencies that can see your data is bound to result in some turbulence trying to maintain similar security levels. I wonder if people can still print?

Re:This just in...

[hedwards]

Printing is a relatively small risk compared with however they smuggled the information out. A paper can only hold a small amount of data. Your average thumb drive can hold far more than a ream of paper can. And it's a small fraction of the size.

Forcing them to print the materials doesn't stop leaks, but it does greatly slow the process and greatly increase the likelihood of them getting caught trying to smuggle the stuff out of the building.

Re:This just in...

[Anonymous Coward]

You know they've got wireless printers now, right? A printer could just be running on an inverter in some car out in the car park and the paper would never have to pass through security in the lobby.

Still, it's probably far easier to upload the archives digitally via e-mail, FTP or some other means.

Re:This just in...

[tomhudson]

You can encode a lot of data in microprint on a ream of paper. At 10,000 char/square inch, or 750,000 char/page, single-sided (1-2" margins), single sided, that gives a double-sided ream of paper 750 megabytes.

That's a LOT of cables on one ream.

Going to 1200dpi can give you 8 megabytes per page. At that point, all of Wikileaks fits on one ream, not just the cables.

Re:This just in...

[grcumb]

Sharing secrets with more people MAY have a risk of more people knowing your secrets. Shocking.

Seriously though, adding a bunch of people/agencies that can see your data is bound to result in some turbulence trying to maintain similar security levels. I wonder if people can still print?

You know, one way to reduce the threat of leaks might be to stop classifying everything even remotely contentious (or honest) as Secret.

Seriously. It's a hell of a lot easier to protect and ring-fence 1000 documents that really, really need to be protected than it is to try the same thing with a quarter million of them.

One of the many services that WikiLeaks has rendered us is showing just how the knee-jerk tendency to designate everything Secret or Confidential doesn't serve any useful purpose.

Re:This just in...

[Jeremy Erwin]

Well, there is "Top Secret". The cables that were leaked were all classified as "Secret" and "Confidential", so the classifiers must be doing something right.

Re:This just in...

[grcumb]

Well, there is "Top Secret". The cables that were leaked were all classified as "Secret" and "Confidential", so the classifiers must be doing something right.

Agreed.

Nonetheless, the point still stands that many of these cables would be absolutely uncontroversial with only one or two small edits. It wouldn't even be necessary to alter the content, just the phrasing.

An example: In one cable, the Secretary of Defence is quoted, saying that the Saudis are willing to fight Iran 'down to the last US soldier.' It would be sufficient to say 'the Secretary observed that the Saudis were reluctant to commit to sharing the burden of such an undertaking.' Perfectly clear, still true, but not controversial any longer.

Re:This just in...

[Jeremy Erwin]

Perfectly clear,

Obfuscated.

still true,

Quite Possibly

but not controversial any longer.

The opacity helps with that. A controversy needs to be exciting. You've made it dull.

the problem is to much marked classified

[cenobyte40k]

If we didn't mark everything under the sun as classified it would be a lot easier to keep the stuff we need to keep secret that way. Only about 5% of what WikiLeaks has put out ever needed to be classified to begin with, and 95% of that didn't need to be classified anymore.

Re:the problem is to much marked classified

[vxice]

Actually only 46% was indeed marked classified. 6% was marked secret. None top secret. That is the whole point of classification levels.

Re:the problem is to much marked classified

[tomhudson]

Sorry, citizen, but how we determine what IS and is NOT classified is classified information. So we tell them to classify everything, because they are not cleared to have this obviously sensitive classified information as to how we determine what is classified.

Now please do your duty and burn your eyeballs out with bleach, because even this information is meta-classified. Your government thanks you - and remember, we're watching!

Re:the problem is to much marked classified

[thesaurus]

Sorry, citizen, but how we determine what IS and is NOT classified is classified information.

It's fun to be snide, but sometimes the facts get in the way. How the U.S. Govt. determines what should and shouldn't be classified is spelled out in Executive Order 13526, the text of which is not classified.

Sec. 1.4. Classification Categories. Information shall not be considered for classification unless its unauthorized disclosure could reasonably be expected to cause identifiable or describable damage to the national security in accordance with section 1.2 of this order, and it pertains to one or more of the following: (a) military plans, weapons systems, or operations; (b) foreign government information; (c) intelligence activities (including covert action), intelligence sources or methods, or cryptology; (d) foreign relations or foreign activities of the United States, including confidential sources; (e) scientific, technological, or economic matters relating to the national security; (f) United States Government programs for safeguarding nuclear materials or facilities; (g) vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or protection services relating to the national security; or (h) the development, production, or use of weapons of mass destruction.

http://www.whitehouse.gov/the-press-office/executive-order-classified-national-security-information

Re:the problem is to much marked classified

[stubob]

No, that would be silly.

I am dumb.

[Anonymous Coward]

I spent about five seconds staring at the title of this post, then I realized that "Intel" as in the processor company was the same word as "Intel" as in intelligence. Mind blown.

Why doesn't anyone mention the actual problem

[kawabago]

The real problem is the US government killed innocent people and covered it up. A soldier with a conscience decided his government should fess up and released all the documents. If the US government had been honest about it's mistakes and misdeeds, there would have been no motivation for a leak. When the US government breaks it's own laws and goes to great lengths to obstruct justice, it can expect this kind of release of confidential information because American soldiers have also been taught to do what is right. Forcing the government to admit it's illegal actions is the right thing to do.

Re:Why doesn't anyone mention the actual problem

[ScentCone]

A soldier with a conscience decided his government should fess up and released all the documents

Ah, so because you don't like how a particular combat event played out, you think it's appropriate for diplomats dealing with very difficult foreign governments to not be allowed to frankly discuss the situation with their co-workers, out of the public eye (and away from monitoring by the very government being discussed)? You don't think that an important protest and opposition figure in Iran should be able to retain his anonymity while discussing circumstances inside that regime's thugocracy, because ... what, it's better he's dead at the hand of that government than that he rely on non-public communication with foreign diplomats and supporters? So glad you have the big picture, here.

Re:Why doesn't anyone mention the actual problem

[NoSig]

So because you don't like how some frank discussions were revealed, you think it's appropriate to cover up killings and who knows what else under a veil of "classified"? So glad you have the big picture, here. That's a particularly unproductive way of arguing as perhaps you now appreciate.

Re:Why doesn't anyone mention the actual problem

[ScentCone]

No. Non-public communication and record keeping is a necessary part of running a government. It's absolutely productive to point that out and recognize that it's true. The argument being passed around, here, is that nothing the government does should be out of instant, continual public reach. That's wrong in principle and in practice. It's not that I don't like how some frank discussions were revealed ... it's that I don't like the contention that no diplomats should be allowed to have frank discussions at all. That bit of absurdity is so sophomoric that it has to treated as a troll.

Re:Why doesn't anyone mention the actual problem

[jc42]

Ah, ... you think it's appropriate for diplomats dealing with very difficult foreign governments to not be allowed to frankly discuss the situation with their co-workers, out of the public eye (and away from monitoring by the very government being discussed)?

Red Herring Alert!

Does anyone really think that anyone in their country's diplomatic corps isn't fully aware of what sort of talk goes on "in private" among their cohorts in other countries? C'mon; these leaks didn't have any effect at all on any diplomatic discussions anywhere. That's just a ruse by the politicians to try to discredit the wikileaks folks. And those of us who are at all familiar with the situation just laughed at it.

If anything, it's this sort of clumsy propaganda effort that discredits our diplomats. The diplomats in other countries have got to be chuckling when they read of such things coming out of the "Land of the Free".

Re:Why doesn't anyone mention the actual problem

[t2t10]

The real problem is the US government killed innocent people and covered it up.

That may well be the case, but it is not what Wikileaks has shown. Wikileaks showed that Iraqis killed more Iraqis than we previously suspected and the US didn't keep a full tally.

Forcing the government to admit it's illegal actions is the right thing to do.

It is the right thing to do, but Wikileaks hasn't done that.

Re:Why doesn't anyone mention the actual problem

[mdsolar]

It is illegal to use classification to cover up a crime or even a mistake. But you are really supposed to take the issue up with the classifying authority and then their superiors if that does not work. Each branch has an Office of Inspector General which ought to be able to deal with the misuse of classification. Further,. a person with a clearance is sworn not to reveal secrets. But, there have certainly been times when the abuse of classification has been so pervasive that only leaking could serve to rectify the wrongs. Don't know it this is one of those times. Most of what has been reveal so far seems to have been secret for a good reason: protecting sources or methods. Another aspect is that it is pretty hard for someone in the Army to object to the misuse of classification by the State Department. It is not in the chain of command. One could be right of wrong that classification has been abused but have no internal way of addressing the issue and perhaps be frustrated enough to leak.

Re:Why doesn't anyone mention the actual problem

[ScentCone]

If anything, it's this sort of clumsy propaganda effort that discredits our diplomats.

You obviously haven't been actually paying attention to the information that's coming out. This is public disclosure of cables from our own diplomats back to officials in the US, detailing - among other things - topics like how we're interacting with foreign governments as we conduct actions against terror cells, or what sort of cover a counter-terror operation is being given by another government. Or the identity of opposition figures in Iran's population. Glad you're so glib about it, though.

Re:Why doesn't anyone mention the actual problem

[grcumb]

Forcing the government to admit it's illegal actions is the right thing to do.

It is the right thing to do, but Wikileaks hasn't done that.

No, you're right. WikiLeaks hasn't done that. They just distribute the information. What happens after that is up to you.

Re:Why doesn't anyone mention the actual problem

[cold fjord]

So because you don't like how some frank discussions were revealed, you think it's appropriate to cover up killings and who knows what else under a veil of "classified"?

There are procedures for dealing with questionable deaths on the battlefield, both as potential war crimes and for compensating the victim's families. Manning didn't make use of them, but instead collected and distributed secret government documents to do as much damage as he could. Now we are dealing with informants against terrorists being killed, disruption of highly sensitve diplomatic discussions that could lead to open war, and more destabilization of the Middle East.

EU officials give first analysis of WikiLeaks impact

More investment in European External Action Service (EEAS) security, loss of goodwill in the EU's special relationship with the US and heightened tension in the Middle East are all likely consequences of the WikiLeaks scandal, EU insiders say.

Loose lips sink friendly ships

The publishing of the stolen secret documents by Wikileaks makes about as much sense as protesting problems with the Social Security Administration driving some people to suicide due to delays by publishing the social security number of all Americans and exposing them to identity theft, fraud, and other problems.

Wikileaks is worse than that - it's actions will result in people being killed, and maybe a fresh war or two.

Re:Why doesn't anyone mention the actual problem

[budgenator]

Oh it's even worst than that, Countries are plotting to subvert IPCC and it's fight to prevent global Climate change.
For example in Bolivia, Morales, the President, is pre-enviroment in public, but pro-industrialization. Lot's of people suspect that when the cables are really analyzed, they'll blow away the climate-gate email leaks and we'll find out about which Greens are really closet deniers in it for the fame and money.

Re:Why doesn't anyone mention the actual problem

[ScentCone]

I'm sure secrecy is productive any government. But is it productive for democracy?

A government stripped of the ability to conduct the affairs required of it cannot protect the environment in which the democracy lives. People who want to own the democracy don't have to worry about being caught if every action of the agencies charged with enforcing the law are telegraphed in public. You want a democracy? It requires rule of law. Rule of law means being able to actually do something about people who break it, including dealing with sneaky ones that require the work of people like undercover cops.

Re:Why doesn't anyone mention the actual problem

[chord.wav]

Parent is a must read.

Re:Why doesn't anyone mention the actual problem

[NoSig]

To the people who responded to my post as if I actually had made the argument in the first half: I was saying that the argument was being made in a particularly inane form. Given that I think that, and was trying to show that, I was not actually myself trying to make an argument in that same form.

Re:Why doesn't anyone mention the actual problem

[protektor]

That is a flat out lie. WikiLeaks has redacted all names that are not well know or public figures. To say otherwise is to lie. Also why in the hell are you putting mission operations in "Confidential" security level documents? They aren't because that type of info wouldn't be in these documents that are only "Confidential" clearance documents. Mission operations, and counter-terror operations document are "Top Secret" and these are not "Top Secret" documents. You need to do a lot more research on this. It is clear you haven't actually read any of the released documents and are only repeating talking points. The information you claim to be a problem isn't even in the documents. The clearance level you claim these documents are, is wrong. The person who stole the documents doesn't even have a "Secret" level clearance, so he couldn't have stolen anything "Secret" level or higher. So do you want to try again?

Also it doesn't matter what security level the documents are. The Supreme Court has already ruled the press can print "Top Secret" documents when it is news worth or in the interest of the public. These are clearly both since every mainstream media source is releasing information contained in these documents and some are releasing the actual documents. So what is happening here is 100% legal in the United States. End of story.

Re:Why doesn't anyone mention the actual problem

[ScentCone]

That is a flat out lie. WikiLeaks has redacted all names that are not well know or public figures. To say otherwise is to lie.

You are incorrect, and you'd know that if you bothered to read what's being released. They've specifically given away enough details to identify just the sort of person mentioned. Assange holds back a name, but is happy to point out that the person he's "protecting" with anonymmity is a UK-educated engineer from prominent Pre-Revolution Isfahan family who once owned a large factory in Iran and is a former national fencing champions of Iran, former president of the Iran Fencing Association and former vice-presidents of an Azerbaijan sports association. Why, that could be any of millions of people, right? Way to go, Assange!

Re:Why doesn't anyone mention the actual problem

[rastoboy29]

Uh, this happened?  Link?

Re:Why doesn't anyone mention the actual problem

[t2t10]

No, you're right. WikiLeaks hasn't done that. They just distribute the information. What happens after that is up to you.

No, they didn't even do that. They distributed information about uncounted Iraqi deaths, and then semi-literate people with an axe to grind interpret that to be killings by Americans.

Doubtlessly, the US did kill innocent people and covered it up; that happens in every war. Wikileaks, however, has done little to help with uncovering that.

Don't get me wrong: I don't mind Wikileaks, but their importance is vastly exaggerated, and they are clearly being used and misrepresented for propaganda purposes.

Re:Why doesn't anyone mention the actual problem

[budgenator]

I was being sarcastic

Do the words, "Pentagon Papers" ring a bell?

[Chris Tucker]

" 'words on paper can be made secure, electronic archives not.'"

Really? Really? You really said that and seriously meant it?

Re:Do the words, "Pentagon Papers" ring a bell?

[tomhudson]

They were probably thinking of "burn bags" - even shredders are useless.

Re:Do the words, "Pentagon Papers" ring a bell?

[jc42]

" 'words on paper can be made secure, electronic archives not.'"

Really? Really? You really said that and seriously meant it?

Oh, c'mon; securing words on paper is trivial. All it takes is a small fire. Do you know of any way to reconstruct the text from the ashes?

This provides really high security. It makes the text secure from decoding by anyone.

[Emboldening mine, of course, for emphasis.]

Re:Do the words, "Pentagon Papers" ring a bell?

[Chris Tucker]

Burning paper does not secure the words and images thereon. It merely destroys THAT particular paper the words and images are on. If there's even one copy, then the information in that particular destroyed document is not 'secure'.

The Pentagon Papers were secure... until Ellsberg loaded them into photocopier and sent copies to the NY Times.

Securing information is difficult at the best of times. It needs to be available to authorized parties and yet kept safely secured from unauthorized eyes.

Burning only secures out of date information, notes, etc, as well as destroying sensitive information in the case of, say, an invasion of your embassy, military base or captured aircraft or warship.

Re:Do the words, "Pentagon Papers" ring a bell?

[sumdumass]

Well, some paper will retain a shape and imprint of the ink printed on it when burned. You can actually see the words in the ashes of the paper unless they have been stirred and mixed around.

But even then, I do not think that burning paper is a security method for storage and use unless you are concerned about invasion of some sort. I mean seriously, if you have a file cabinet loaded with paper files, how are you going to burn it if you don't know that someone is taking/making copies of it.

burning has it's advantages when destroying the information is more valuable then keeping it around. Outside that, it's not really a security solution as the information typically needs to be around.

Re:Do the words, "Pentagon Papers" ring a bell?

[budgenator]

We used to burn inside a 55 gallon drum on a spit that had a screen to sift the ashes, that's for routine burning, for a quick burn due to being over run, a themite grenade or two is placed on top of and set off on security container which would have been very fast and messy. A thermite grenade will burn through an diesel truck engine so a security vault or safe is no problem.

Re:Do the words, "Pentagon Papers" ring a bell?

[DerekLyons]

" 'words on paper can be made secure, electronic archives not.'"

Really? Really? You really said that and seriously meant it?

Um, yeah. Because it's roughly as obvious as gravity to anyone with any actual knowledge of security.
 
You remember the Pentagon Papers because it was huge, but it doesn't seem to have occurred to you to notice that a) the Pentagon Papers were actually just a relative handful compared to the Wikileaks releases, and b) there have been few or no similar episodes in the four decades since.
 
There's a reason for that.

Re:Do the words, "Pentagon Papers" ring a bell?

[uninformedLuddite]

See even Pvt First Class Accounts Clerks have fun in the army

Re:Do the words, "Pentagon Papers" ring a bell?

[Chris Tucker]

I was referring to the statement that "PAPER" can be secured better than digital information.

The Pentagon Papers were just that: Paper. Despite the TOP SECRET designation stamped on each sheet of that paper, they were photocopied and distributed.

Re:Do the words, "Pentagon Papers" ring a bell?

[DerekLyons]

I was referring to the statement that "PAPER" can be secured better than digital information.

No shit Sherlock. And just which statement do you think I was replying to? Here's a clue for you (since you so obviously badly in need of one): It's the only fucking statement in your post.
 

The Pentagon Papers were just that: Paper. Despite the TOP SECRET designation stamped on each sheet of that paper, they were photocopied and distributed.

No shit Captain Obvious. Did you bother to read and comprehend what I wrote in reply? In faint hope that this time you'll understand it, I'll repeat myself:

"You remember the Pentagon Papers because it was huge, but it doesn't seem to have occurred to you to notice that a) the Pentagon Papers were actually just a relative handful compared to the Wikileaks releases, and b) there have been few or no similar episodes in the four decades since.

There's a reason for that."

Re:Do the words, "Pentagon Papers" ring a bell?

[Chris Tucker]

"Arguing on the Internet is like the Special Olympics: Even if you win, you're still a(n obscenity spouting) retard."

YOU WIN!

Vanna, tell him what he's won...

If you think this is bad

[Anonymous Coward]

Sharing of AMD is even worse.

Re:If you think this is bad

[pipedwho]

Sharing of AMD is even worse.

Could be worse again if it was WMD.

Fools at the Washington Post...

[Anonymous Coward]

Of course it has to be a binary switch. You must either share all documents and be insecure, or not share any documents and be totally secure. Any middle ground is impossible. Thus the correct response to WikiLeaks must be to lock down all the documents and make sure nobody reads them at all. Only this will keep us safe!

That sounds like the same kind of logic that comes from a town that sends troops to Iraq in response to a threat from a man in Afghanistan, or that would like to repeat the policies of Herbert Hoover in response to a big recession, or would rather raise the retirement age on working stiffs than tax billionaires at 1999 rates. As always, these conclusions are treated as an inevitability -- there's just no other way to go.

That's not the classified guidelines I worked with

[Decker-Mage]

While I was serving in the military and handling classified material on computers the regulations on data handling were quite clear. Classified material was never to be stored or manipulated on an unclassified system. Furthermore, even on classified systems the classification of the system set a maximum clearance level, material classified secret could not be handled on a classified confidential system, etc. You could handle confidential on a secret system but then it could never be put back on a classified confidential system. I can understand, in light of the 'connect the dots' problem that you need to have access to pretty much all material in the hopes someone will get the 'Eureka' moment but storing, even allowing access the wrong way is what gets you into this kind of mess and supposedly we had procedures to prevent it. Obviously not after 9-11.

And on that topic, post 9-11 changes, the Republicans, and Democrats when they wake up to this fact, can stick it. The post 9-11 changes to the handling classified material happened under a Republican administration at the behest of (severe pressure from) Congress on both sides of the aisle. As with the mortgage meltdown, Congressional members are pointing everywhere else but at themselves.

more sharing, but not for everyone

[Skapare]

More sharing is needed, and clearly they've done that to at least some extent. The problem is they included too many people in that sharing. Full access to "everything" should be limited to specific analysts with top clearance, and years of experience doing work under clearance (and thoroughly background/personality checked). It should NOT be for front line soldiers, which instead should have limited NTK access.

Re:more sharing, but not for everyone

[budgenator]

Manning was staioned in a Brigade level assignment, about 3 management levels above front line troops

Shares of Intel

[rossdee]

So we should invest in AMD then?

Re:Shares of Intel

[fishexe]

So we should invest in AMD then?

No, just keep your Core i7s to yourself.

What direction you want to take?

[gmuslera]

Forward and fast, or backward and damn slow? Information sharing and collaboration have pluses too, denying it you are probably doing more damage for sure, and in a far broader area than the eventual leak of it could do. You have to take a compromise between security and functionality, and being aware what will cost those security restrictions.

Politics would be simpler if we could peek into our future to see what will bring our choices, too bad those damn blue butterflies are waiting for us right there.

Fixed summary.

[w0mprat]

The bottom line is that recent leaks 'have exposed gaping wide security holes' in the framework by which governments guard their secrets.

TFTFY Timothy

Next time, skip the "Intel Inside" sticker

[tomhudson]

The approaches do need to be more sophisticated.

You mean like using a cell-phone camera to take a picture of a screen?

You can also encode a LOT of info into just one jpg or png of the family dog.

As for printing, you can use a 600dpi laser to output the whole bible in encoded format on 5 sheets of paper. So yes, you could walk out with 250,000 cables pretty quickly.

Re:Next time, skip the "Intel Inside" sticker

[jmac_the_man]

They did.

Re:Next time, skip the "Intel Inside" sticker

[omni123]

The approaches do need to be more sophisticated.

You mean like using a cell-phone camera to take a picture of a screen?

You can also encode a LOT of info into just one jpg or png of the family dog.

As for printing, you can use a 600dpi laser to output the whole bible in encoded format on 5 sheets of paper. So yes, you could walk out with 250,000 cables pretty quickly.

Not every office has the kind of hardware (or every person the skillset) required to minimise documents at the drop of a hat like that. While I concede that methods for this are readily available on the internet a lot of people with access to this intelligence just don't have the expertise to step through it and that is a strong enough deterrent in a lot of cases.

Keep in mind I am limiting my discussion to internal patriotic staff members 'freeing America' etc and not a well placed terrorist or foreign intelligence officer--that would be an entirely different ball game and arguably more-so a problem for security vetting offices.

Cameras with cell phones are banned at most defence facilities in the US I would imagine. That being said satellite locations are obviously a serious concern given the origin of the diplomatic cables.

Re:Next time, skip the "Intel Inside" sticker

[syousef]

As for printing, you can use a 600dpi laser to output the whole bible in encoded format on 5 sheets of paper.

Yeah but how hard is it to encode something as repedative as blah blah begat blah blah begat blah blah....

Re:Next time, skip the "Intel Inside" sticker

[tomhudson]

600 dpi printers are no big deal. As well, encoding the info doesn't mean literally shrinking the fonts - there are other ways to encode the information - you can even encode it as "defects" in the regular fonts so that an apparently innocuous email contains the actual data. Anyone with a web browser and the ability to run some javascript can do it.

So it's one of those cases where unfortunately, stuff is going to leak no matter what. There are some problems that are simply not solvable.

Re:Next time, skip the "Intel Inside" sticker

[fishexe]

Yeah, but would Bradley Manning have figured out how to do anything of these things? Remember, this was the guy who thought listening to Lady Gaga at work was such a clever ruse.

Re:Next time, skip the "Intel Inside" sticker

[dargaud]

As for printing, you can use a 600dpi laser to output the whole bible in encoded format on 5 sheets of paper. So yes, you could walk out with 250,000 cables pretty quickly.

Do you know of any printer/scanner software that can do the encoding/decoding so as to do printed backups ? Something with redundancy like rar or turbo codes that prints out a page of pixel soup... I'm not sure how useful it would really be, just curious.

Re:Next time, skip the "Intel Inside" sticker

[Magada]

It was, in that he slipped out reams of data, undetected. He was only stupid in bragging to known snitch Lamo.

Re:Next time, skip the "Intel Inside" sticker

[jimbolauski]

He was only stupid in bragging to known snitch Lamo.

So it was noble of Assage to publish classified documents including the names of Afghan informants thus putting their lives in danger,under the ruse of being open, and it was noble of Manning to turn this information over but when Lamo received information of a giant leak of classified information that could put many lives at stake (remember he had no idea was the information was) he is a snitch.

Re:Next time, skip the "Intel Inside" sticker

[Firethorn]

Anyone with a web browser and the ability to run some javascript can do it.

Question: Does this ability require access to the internet? Because classified networks, on average, don't. The standard user also don't have the ability to install programs.

It becomes one of not so much preventing all leaks, but restricting them to a dozen documents, not 30k or so.

Re:Next time, skip the "Intel Inside" sticker

[apavel]

You can use optar: http://ronja.twibright.com/optar/

Re:Next time, skip the "Intel Inside" sticker

[Magada]

What names? Name one informant that has been put in danger.

Lamo is a snitch for snitching on Manning, the content of the documents notwithstanding. A rose by any other name...

Re:That's not the classified guidelines I worked w

[vlm]

While I was serving in the military and handling classified material on computers the regulations on data handling were quite clear.

Of course this changes in both time and place... I was in the us army early 90s era so your experience will probably vary.

You could handle confidential on a secret system but then it could never be put back on a classified confidential system.

Obviously allowed, not never, although it happened via certain procedures not just randomly shuffling data.

For an obvious close personal example, the fact that my ASP had a particular crate of 5.56mm rounds with a certain NSN and lot number is not sensitive (more like, "duh") but an aggregated report of all ammo supply stocks for the entire theater, held a much higher classification.

how do you disable writing to external drives?

[0111 1110]

For example, officials said they were disabling all "write" capability to removable media such as thumb drives or disks, on DoD classified computers,

Can someone take pity on me and explain what the heck they are talking about here? Unless a "classified" computer is very different from a regular one, I don't understand how that is possible. I guess you could try to desolder and remove all of the external USB and/or esata and/or firewire ports from the motherboard in addition to removing any pins on the motherboard that are made to give you additional ports. Wouldn't you have to also remove any unused PCI slots as well? Even after doing all that someone could just open the case and plug an internal drive into a spare sata port and PSU power connection. I guess you may be able to defeat that by removing all the sata and pata ports from the motherboard except for one port for a connected hard drive. You couldn't have multiple hard drives because someone could just unplug one.

Re:how do you disable writing to external drives?

[MichaelSmith]

None of that is hard to do. The US government could buy custom systems with exactly the external interfaces they need. They could install an OS which does only what they require. They could use thin clients everywhere and not provide a screen shot function.

Re:how do you disable writing to external drives?

[mmcxii]

You can do it with software. Look over this for starters.

Re:how do you disable writing to external drives?

[GumphMaster]

We used to remove all writeable removable storage devices from machine and their corresponding drivers from the operating system. We found that two-part epoxy was an expedient method of disabling physical USB, firewire, and unused network interfaces. Ultimately this was only a precaution because the machines concerned spent their entire life inside a PC-sized safe bolted to a desk, with only the necessary network, keyboard, mouse, and video cables exiting.

Re:how do you disable writing to external drives?

[froggymana]

Well, if someone truly wanted to then they could cut the keyboard or mouse cord and bring their own USB A female connector with wires attached and connect it that way. But OTOH that probably wouldn't work if they were PS/2 mice/keyboards.

Re:how do you disable writing to external drives?

[GumphMaster]

Which is why we also removed the drivers from the machines.

Re:how do you disable writing to external drives?

[froggymana]

Ah, that would make things a bit more secure then.

Just out of curiosity, what exactly is this machine used for that requires such high levels of security?

Re:how do you disable writing to external drives?

[GumphMaster]

I could tell you but...

Re:how do you disable writing to external drives?

[froggymana]

Ah, thats what I figured

Wait, wait.

[drolli]

You really want to tell me that up to now anybody could put in his 64GB USB drive and copy all the data he/she wants to copy? Seems relaxed to me taken into account that probably the entrance is guarded by an armed guard.

Re:Wait, wait.

[Jeremy Erwin]

Manning apparently was able to burn a CD (labeled "Lady Gaga"). Now I don't know what kind of computer he was using, but on my system, burning a CD is slightly more complicated than using a flash drive-- it involves an extra program, or at least an explicit "Burn" command.

Re:Wait, wait.

[evought]

At one point I was responsible for transferring four classified laptops (they were fully loaded Sun Solaris laptops (by Tadpole, I think) and therefore rather expensive), external hard drives, and a pile of DAT tapes out of the Pentagon to a new secure facility elsewhere. All of the laptops and all of the (4-8GB) tapes were Top Secret. I had all of the paperwork, it was a legitimate transfer, and I followed all of the rules. When I got down to the Metro Station entrance (there is a DC Metro terminal connected directly to the first sub-floor of the Pentagon), I waited in line for the guard to check my paperwork and the file cart with all of the equipment. Unfortunately the guy in front of me had NOT filled out his paperwork correctly and got in a protracted argument with the guard (and yes, the guard was armed). This went on long enough that the exasperated guard waved me through. No one looked at my paperwork. No one looked at the cart or what was on it.

We were told in one of the first security briefings that bad guys will often use the buddy system to work the guards. The first guy causes a minor but hard-to-resolve problem; the second guy walks out with all of the data. I am sure the guards were briefed on this too, but guards are human and have human weaknesses. They get bored, they get frustrated, and their job becomes routine. Often enough they don't want to give people like me trouble who were not causing any trouble for them. The fact that I was standing there politely probably had a lot to do with him waving me through. But a professional would have been calm and courteous and would have acted just like I did... and might have walked out with the whole kit and kaboodle. The equipment I was carrying alone was probably worth $100 grand at the time. Any extra equipment on the cart would have had no paper trail. Luckily I was a good guy; not everybody is.

That is why you need security in depth and you need to use the buddy-system to make sure that one distracted guard doesn't let something by that he should not. But that is expensive and budgets are always under pressure. You also need to have a system where people believe they are on the right side and want to help protect the secrets because they know good people's lives depend on them. Corruption gets people killed as much as loose lips.

Words on Paper Secure

[protektor]

You can make words on paper secure? Really? Are you sure about that? I seem to recall at least one time when that wasn't the case. I seem to recall some "Top Secret" level documents that got out. You may better remember them as the "Pentagon Papers". Oh and then I remember another time someone leaked information and a few papers to the newspapers. You might remember it better as the "Watergate Scandal".

http://en.wikipedia.org/wiki/Pentagon_papers
http://en.wikipedia.org/wiki/Watergate

Now what was that about words on paper can be made secure but not electronic archives? They are both the same. You can make them secure, but if someone wants to release the information then there isn't much you can do about that. The human being in the equation will always be the weak link. Someone committed to releasing the information will find a way eventually. History is proof of that.

A downside to what?

[RavenousBlack]

This is a downside to the government doing something that they don't want others to know about in the first place. The downside comes from the fact that this information exists, not that it leaked. The quote on the bottom of the page is very appropriate right now. "Truth is hard to find and harder to obscure"

Re:This is NOT about "intel"

[MichaelSmith]

This is why the so-called open source movement is far more profound than people realize; it's not just about software, it's about putting an end to ALL secrets and finally achieving true freedom for all (as opposed to a few). We need open source government, and an open source government doesn't keep secrets and doesn't need information-sharing lockdown protocols.

What color is the sky in your universe? There has never been an organization which didn't keep secrets. Many of us keep secrets from ourselves. A totally open government would quickly be destroyed by non open governments.

Re:'WikiLeaks:TMZ' - SNL gets it right!

[Bryan-10021]

The skit was really fun. Nice to see SNL treating Assange for what he is.

Re:'WikiLeaks:TMZ' - SNL gets it right!

[MichaelSmith]

During the sketch, a message from President Obama (Fred Armisen) gives way to a staticky screen, which then reveals a greasy version of WikiLeaks founder Julian Assange (played by Bill Hader).

"Hi America, I have taken over your airwaves," he says in an Australian accent. "The leaks did not inspire a revolution as I had hoped, so tonight I present a new WikiLeaks, where the leaks are even more embarrassing and the details are even more sordid."
The screen flashes the title, "WikiLeaks: TMZ."

Ha! Cue Dennis Hopper.

WikiLeaks shows there are government issues

[protektor]

WikiLeaks is showing that there are multiple problems with the government in the US. There is a problem of making sure people aren't walking out of buildings with information that they shouldn't. There is the problem of our government telling us one thing, and the truth being something completely different. Everyone thinks the leaks were this super secret, bad for the troops and the country, information. Remember none of this is "Secret" or above. This is all stuff classified "Sensitive". So I can't imagine that operational details that would effect anyone would only be classified "Sensitive" that would be kind of crazy. Also names of common people are being redacted, so as not to cause them any problems.

Security classifications starting at the lowest level for the US are: Controlled Unclassified Information, Confidential, Secret, Top Secret, and Compartmented Information. "Controlled Unclassified Information", such material might cause "undesirable effects" if publicly available. It controls who is allowed to see these documents. This is not a clearance level but rather a classification level for documents. "Confidential", such material would cause "damage" or be "prejudicial" to national security if publicly available.

That is what we have here, confidential documents. Documents that they didn't want getting out because it would make them look bad and show that they lied. The person who stole these documents was a first class private. He didn't have access to "dangerous" secrets. There would be no need for him to have a "Secret" or "Top Secret" level clearance at his rank.

Did he steal? You bet. Is he going to jail over it? I would be surprised if he didn't. Is WikiLeaks a terrorist organization? Don't be silly, if they are then so is every newspaper who posted the same information, and there are dozens of mainstream news outlets that posted this information. There are even a few newspapers who printed the raw cables not redacted with the names of even common people showing. WikiLeaks has made sure to redact all the common man/non-pubic figure names from the cables before posting them on their website.

We still have freedom of the press in the US, and it doesn't say who is allowed to be press and who isn't. The Supreme Court has ruled that the media outlet that receives these documents can not be held liable for their theft. The media outlet can release the information if there is clear news value, and value for the public to know the information. Does the public need to know the government lied? You bet they have a right to know that. Does the public have a right to know officially that friends of the Saudi Arabian government are funding Al-Qaeda? You bet. Does the public have a right to know that the US is bombing Yemen rather than the Yemen government? You bet. If none of this was news worthy they wouldn't be printing this information, they would instead be just talking about the leak of information.

Re:WikiLeaks shows there are government issues

[t2t10]

WikiLeaks is showing that there are multiple problems with the government in the US.

And you needed WikiLeaks to figure that out? Of course, the US government lied, just like it has for every war that we have ever entered. To anybody with half a brain, that was clear before we even entered these wars, as was the fact that lots of civilians would lose their lives and that US soldiers would commit war crimes, like all soldiers in all wars. Bush went into these wars with high approval ratings. Americans wanted this, despite the clear evidence on the table at the time, and now they don't want to take the responsibility for the waste of money and time it has been. Europeans are just as bad, living with the delusion that they aren't part of this, all the while their governments clearly participate and back pretty much everything the US did, and they and their corporations profit handsomely. Wake up, people, you're just looking for excuses to assuage your guilty consciences.

Re:WikiLeaks shows there are government issues

[budgenator]

Generally speaking I believe the E4 and above are normally expected to have a Confidential clearance, E6 and any Commisioned or Warrant Officer are normally expected to have at least Secret and W3 and O4 generaly have Top Secret. Frequently a particular job or assignment would require a higher Clearence for individuals. I wouldn't be suprised if Manning held a Secret and his boss a Top Secret.

Re:WikiLeaks shows there are government issues

[protektor]

The government lied about the reasons to going to war in Iraq. They waved around reports and papers and said it all proved why we need to go in. We believed the government. Now we find out they lied...well that sucks. Ok if you lied to us come home then, since we don't want a war that isn't justified.

That is what happened, and it isn't crazy to say the US public doesn't want to be there. We are not delusional, we were lied to and we are trying to correct that. I have no guilty conscience. I was lied to and there is nothing I can do about that. I didn't even get a vote about the war. Even if I hated the war, they sure didn't ask me or let me vote on it. The congress just did it, and off to war the country went.

American's have a problem believing that their government would lie to them. If you try and suggest it then the media in the US labels you a crazy conspiracy nut job. Well guess what there are conspiracies in the US government to hide greed and wrong doing. We are finding out there are conspiracies in the Federal Reserve and financial industry as well, for greed and wrong doing. America is finally starting to reach the boiling point. Will the public explode and start fighting the government? Who knows, maybe, maybe not. The Tea Party movement was an attempt to break away from the 2 party system in this country. Since we don't really have 2 parties, we have 2 wings of the same party, Republicans on one wing and Democrats on the other wing. Now we have Republicans trying to co-opt the Tea Party and bring it in to the Republican fold to get control back, and keep things the same.

Re:WikiLeaks shows there are government issues

[t2t10]

The government lied about the reasons to going to war in Iraq. They waved around reports and papers and said it all proved why we need to go in. We believed the government. Now we find out they lied...well that sucks.

If there had been no other information source than the government, you'd have a point. But the facts were out there and widely published, and it was clear before the US even went to war that the US government was lying, just like it has every time the US has gone to war. It's apparently part and parcel of war in a democracy.

I was against these wars. But most Americans apparently wanted to be deceived: they were angry and confused, somebody had to pay, and they didn't want to have their conscience burdened by facts. And it's no different in other democracies.

Now that that wars have run their course, the US is hundreds of billions of dollars poorer and has a PR problem, and two nations are rid of totalitarian regimes and have a chance at democracy, not such a horrible outcome either.

America is finally starting to reach the boiling point. Will the public explode and start fighting the government?

Why should they? The government is giving Americans what they want, including someone to blame when things go wrong. It works the same way in other democracies.

The Tea Party movement was an attempt to break away from the 2 party system in this country.

If you look at Europe, multi-party systems work no better. European governments lie as well, and they just coalesce into government and opposition quickly, and the minority coalition partners basically get completely subsumed in the majority partner's program.

Why would sharing Intel processors be bad?

[deisama]

I know a lot of you guys are AMD fans, but seriously I think you're being a little over dramatic about them having a higher market share...

The need for FOSS intelligence tools (still)...

[Paul Fernhout]

http://pcast.ideascale.com/a/dtd/76207-8319
http://groups.google.com/group/openmanufacturing/msg/2846ca1b6bee64e1

Imagine these sorts of things applied to, say, medical research and trying to understand how a money trail affects research results...

Re:The need for FOSS intelligence tools (still)...

[protektor]

Nice idea but never going to happen for at least two reason. First one is the shear amount of data that has to be mined because you never know what is and isn't relevant. The second is related to that. The public isn't an analyst. They don't know what is important and what isn't, and what exactly all of that means in relation to other events and comments. Hell not even the CIA knows that. Which is why they have analyst who specialize in different areas of the world, and different sectors of the business and public world. You have to be able to put all these details in context, and that is the hardest problem.

Now one way you might be able to overcome these limitations, has nothing to do with OpenSource really. You might be able to make it work with a public crowd-sourced intelligence database that anyone can access. If you let crowds of people who have huge ranges of interest and knowledge share the load of analyzing things, and then somehow balance differing opinions about the meanings, to get a consensus, then that might work. Somehow have all view points available but consensus would be highlighted as most probable. But that is a *HUGE* maybe. If you could make a kind of "Global Frequency" database and system of intelligence, then you might have a chance to make something really useful. If you really got it to work and could keep it 100% public....it would/could be one of the biggest forms of empowerment for the public/world ever seen, and would shine the light of day into many corners of the world that have never seen light.

But at this point it is just a dream or fantasy.

Re:This is NOT about "intel"

[protektor]

There are very limited times that you would not want to scream your head off about certain information that the government is doing. I can think of at least one very serious and very major secret that had to be kept secret or the US and everyone else was totally and completely screwed. "D-Day" It was vital to keep secret when and where the US was going to do a major beach landing to make a drive for Germany. We lied our butts off and said it was going to be somewhere else, and the Germans moved their troops to that area rather than Normandy. It would have cost untold numbers of lives if everyone had screamed exactly what the government was doing. It cost a lot of lives to do the Normandy invasion, even though it was kept quite. So don't tell me that *EVERYTHING* the government does must be open. That is crap. There are times when the government *MUST* keep secrets.

Now do we need a more open government? You bet. The level of secrecy for the government is crazy, not everything needs to be secret. Is there any reason to keep the financial industry and the banking industry a secret? Absolutely not. Is there a reason to keep secret a majority meetings of senators and representatives? Absolutely not. Keep some of the defense meetings discussing weapons development and status of classified operations, secret. The rest need to see the sunlight of day. We absolutely do not need to keep meetings with lobbyists secret. Do we need to keep things the Federal Reserve does secret? Absolutely not, the public has a right to know how much money is being printed and who is getting it and where it is going. It's our money after all.

If banks or financial institutions fail, it's because of incompetence, not because you exposed their Fed dealings. Bad companies need to fail, not be propped up by the government, that just leads to bigger problems later. You bail out a company once they know they can do anything they want, because you will bail them out again because "they are too big to fail". I think that is crap. If a company is too big to fail then they need to be broken up in to smaller more manageable pieces by the government when they are bailed out.

The government always keeping everything secret only leads to corruption.There is nothing more cleansing for corruption than the light of day.

The answer is moving beyond the irony...

[Paul Fernhout]

http://www.pdfernhout.net/recognizing-irony-is-a-key-to-transcending-militarism.html
"Likewise, even United States three-letter agencies like the NSA and the CIA, as well as their foreign counterparts, are becoming ironic institutions in many ways. Despite probably having more computing power per square foot than any other place in the world, they seem not to have thought much about the implications of all that computer power and organized information to transform the world into a place of abundance for all. Cheap computing makes possible just about cheap everything else, as does the ability to make better designs through shared computing. ...
    There is a fundamental mismatch between 21st century reality and 20th century security thinking. Those "security" agencies are using those tools of abundance, cooperation, and sharing mainly from a mindset of scarcity, competition, and secrecy. Given the power of 21st century technology as an amplifier (including as weapons of mass destruction), a scarcity-based approach to using such technology ultimately is just making us all insecure. Such powerful technologies of abundance, designed, organized, and used from a mindset of scarcity could well ironically doom us all whether through military robots, nukes, plagues, propaganda, or whatever else... Or alternatively, as Bucky Fuller and others have suggested, we could use such technologies to build a world that is abundant and secure for all. "

Re:The answer is moving beyond the irony...

[uninformedLuddite]

Or alternatively, as Bucky Fuller and others have suggested, we could use such technologies to build a world that is abundant and secure for all. "

Having a some sense of decency I feel I must tell you that I have reported you to the Dept. of Homeland Security. I have also requested that Bucky (and his balls) be taken to Guantanamo for a summer holiday.

Re:This is NOT about "intel"

[MichaelSmith]

Show me your tax return. Can I get that on line?

A question of distribution.

[mac1235]

The material in question was too widely distributed to be considered secure. We can assume that any non-US intelligence agencies that really wanted copies has them. (Diplomatic cables are probably not as useful as technological, commercial and military secrets) Now the press has them and it's an issue?

Danger. Really. Danger?

[paulsnx2]

"With better sharing of Intel Comes Danger"

I love this stuff. What Danger?

We are being told that this release of information has harmed the ability of the U.S. to carry out diplomacy. In what way? That we tell lies and other governments tell lies, and now some of these lies have been exposed? What was the "Danger"? Wasn't the danger in the telling of the lies in the first place? Better sharing of Intel didn't bring about this danger.

Besides, if this data dump was so easily acquired (I am assuming the obvious here, that Wikileaks never had to go all "Tom Cruise/Mission Impossible" to get it), surely the data dump was no surprise to various other governments. I'd even guess that this is a fraction of what our enemies know about what we have been saying to ourselves for decades. How could it be otherwise?

So the "Danger" is that increase sharing might also include the public? If there is a change here, it is that the public got into the loop. Is it possible that they might have to abide by a higher level of ethics to avoid embarrassing lies coming out in future leaks? Is it possible that this is the "Danger"?

I am struggling here. So far I haven't heard about anything leaked which can be properly described as a "Danger" appeared with the leak itself. All of the best tidbits I have heard so far that might cause some diplomatic ruffle are due to actions that either 1) Should not have occurred (agreements to lie to the public), or 2) Need not have occurred (Let's call Putin "Batman").

I don't like to negotiate in business with people that live in secret worlds. I don't like the fact that our government loves secrets. The default for government should be to play their cards on TOP of the table, face up. When secrets are really necessary, they become easier to keep if their numbers are few, and the period of secrecy is of very short duration.

Words on paper can be made secure...

[eulernet]

Probably, but it's also much harder to search for a document in paper format.
Electronic format is definitely the best way to find all references to a given information.

Instead of forcing the use of paper, which is the dumbest possible move, intelligence services should reduce the access to documents to the smallest possible number of people.
If sensitive documents are leaked, it means that people who had access to them shouldn't have.

If 3 million of people had access to Wikileaks' documents, this means that they were not so secret !

Which downsides?

[ljw1004]

So far we haven't actually seen ANY downsides of the wikileaks...

* We saw a german official get fired for leaking information to a foreign state
* We saw the Yemeni government conspiring to lie to its people
* We saw the UK foregin office trying to lie to the UK parliament about breaking international commitments on cluster bombs
* US secretary of defense Bob Gates explained that the leaks haven't hurt the US

There have ben only upsides so far.

Re:Which downsides?

[fishexe]

So far we haven't actually seen ANY downsides of the wikileaks...

* We saw a german official get fired for leaking information to a foreign state * We saw the Yemeni government conspiring to lie to its people * We saw the UK foregin office trying to lie to the UK parliament about breaking international commitments on cluster bombs * US secretary of defense Bob Gates explained that the leaks haven't hurt the US

There have ben only upsides so far.

We've also seen the true colors of the mainstream media as pundits who claim to support free speech and free press call for government-sponsored assassination of those actually exercising these freedoms.

Re:Which downsides?

[wvmarle]

It is in a way interesting how these cables get so much more attention than the war records.

Sure there is funny stuff in it, diplomats speaking their heart instead of their mind, and so on. But nothing in those cables that I have seen so far comes as an absolute surprise, more as a confirmation of what we suspected already (like how countries think about each other).

Yet those war records I would expect are much more of a can of worms. Full of records of mistakes by the US army that were covered up, denied, lied about. Those mistakes may or may not be war crimes; the covering up surely should be a crime.

But has any official resigned because of it? Has any trial been opened? I may have missed something but I haven't read or heard anything about it. It is as if these war records are received by the world as "yawn, boring" and quickly forgotten about.

Maybe it's how we think about violence as something normal. Depicting it on TV all the time. Even children's cartoons tend to be pretty violent, with plentiful "collateral damage". I don't know. It just makes me think.

Re:Which downsides?

[meadowsp]

Has to? Why?

Re:This is NOT about "intel"

[macraig]

I'd have no problem with that, but it's not my tax return you really want to see: it's your boss' tax return. He'd of course really rather you not see it, for the same reason that HR tells employees to never reveal their wages to each other: there's exploitation afoot and they'd really rather it not be openly discussed.

Bogus

[ibsteve2u]

According to British journalist Simon Jenkins 'words on paper can be made secure, electronic archives not.'"

That's bogus...anything can be made secure - except people.

But you can make people a lot more secure if you try to avoid screwing this, that, or the other people to help not your nation but a few corporation and/or individuals who are interested in gaining an advantage in trade in the region or access to or a monopoly of the region's resources.

Keeping secrets requires idealism; the most potent solvent for idealism is corruption.

Re:This is NOT about "intel"

[macraig]

It might seem difficult to argue against transparency in the D-Day example. The challenge lies in that fact that transparency demands consensus to be effective, which didn't exist then and doesn't exist now. If it had existed back then, perhaps World War II would not have occurred and D-Day would not have been necessary. It's why President Obama has been unsuccessful in fulfilling his promise; he doesn't have the consensus of others in his own government. The same challenge exists with true consensual socialism; one capitalist fox in a socialist hen house can do damage. By the same token, one person (or nation) keeping secrets in an otherwise transparent world might cause a devolution to old habits.

We might need to strike an uneasy balance between secrecy and openness in the absence of consensus, but news like this makes it apparent that we're at risk of sliding backward down the timeline of human behavior.

Re:Danger. Really. Danger?

[Dystopian Rebel]

I love this stuff. What Danger?

My dear sir, the danger is to politicians who want to stay in power by concealing lies, mistakes, cowardice, knavery and ignorance.

Tiny correction

[Bananenrepublik]

The German guy who got fired (had to resign, actually) was not an official, he was working for his party. He also (probably, IANAL, developing story and all that) didn't do anything illegal, he just misused the trust bestowed upon him. Which probably is worse, even though I don't see how his party (FDP) was in any way hurt by him telling the progress of their coalition dealings with the CDU to the US. Just a jerk trying to be important. And probably the wrong person for the job.

I was fairly disappointed by the first day of this wikileaks release. So American diplomats report back to their foreign ministry about the politicians in their host country, and write the same thing the local newspapers are writing? Wow. What a revelation! Made me lose interest very quickly.

Air gapping

[currently_awake]

secret documents are not allowed on internet connected computers so no email/irc/im. Gov/military Network admins are supposed to be monitoring all network traffic for stuff so that would/should be caught if sent from unclass machines. Blocking cd/dvdrw as well as usb is basic common sense (force all transfers of data through authorized channels). And while they are at it, might i suggest blocking usb autorun to block viruses and spyware. And that only leaves the printers. Unfortunately the only way to block that is with physical security, like marines at the door checking bags.

When I Was Military...

[IonOtter]

I was in the US Navy for nine years, and the system we were using was WinNT.

That was later shifted to an OS called "IT-21". It was a custom version of WinNT that had been cobbled together by SPAWAR. MS actually let them have the source code, so they could customize it. There were all kinds of tweaks, dibbles and fidgets added to it, but the biggest was to disable the USB ports, COM ports, and prevent the system from writing any info to the pagefile.

Now, blocking off the pagefile was a touch of brilliance, but blocking the COM ports meant we couldn't hook a teletype to the computer. So when we were doing HF teletype exercises, messages either had to be loaded using Win98 or done by hand.

And once the newer printers started coming out, blocking the USB ports gave everyone conniptions.

For a while there, they played around with preventing the OS from writing anything at all to the floppy drive, but that lasted all of 1 day when comms shacks all over the WORLD started calling SPAWAR support, screaming about how they couldn't load the CO's traffic to disk.

Soon, the patches came out, and IT-21 became just another hunk of crap we had to deal with. As time went on, we dumped it for Win2K. Before I left, I saw people using Vista Premium for classified traffic, so I doubt things have changed all that much.

At the end of the day, it comes down to three things:

1. Don't do shit that will make your people question your ethics.
2. Screen out people who are, themselves, unethical.
3. Trust but verify.

Bad Idea all around

[OldHawk777]

Information sharing is essential to mission performance, and security is always in the support (never control) role, unless you're idiots.

Thumb-drives/SSD are an excuse not the problem.

Fix the security problems or perpetuate the mistakes.

911 was a failure in information sharing. Field security folks (CIA, FBI...) did their jobs, but C*Os parochialism caused failures.

Do you address the excuse or the failure. To fix the problem you must rationally troubleshoot the failures, and not address reactionary excuses.

Re:This is NOT about "intel"

[protektor]

You might want to double check why there are bases in Saudi Arabia. We were asked by the government to come in to the country and we did. Now everyone in that country may not like it, but that is the fault of their government.

Bin Laden is connected to the royal family in Saudi Arabia and he knows this. He was pointed out to the CIA by the royal family for use in the Afgan wars with Russia. The CIA needed a local for use to pump money and weapons into the area, and rally the fighters in the area to fight the Russians. Bin Laden was pointed out, by Saudi Arabia, to be their man. Saudi Arabia and other locals there also threw in money for the fight against Russia. Bin Laden is pissed that the CIA abruptly pull out and washed their hands of the whole mess when it became clear that Russia couldn't win. He was pissed that he wasn't get money from the US anymore and pissed that the US wasn't supporting him with weapons. This has *NOTHING* to do with bases in Saudi Arabia and he knows this, that is just an excuse. He is pissed that the US and the CIA left him and his group of militants high and dry. He thought he could take over Afghanistan with the help and support of the CIA and the US but that wasn't in the cards, and it pissed him off. That is what this is all about. It's about power and revenge, plain and simple. He can't scream to the people over there that the CIA didn't help him take over Afghanistan so he trumps up something else to rail on the US about. Now that the US is in Afghanistan that really has to piss him off, because he has no hope now of taking over.

Learn more about the Afghanistan and Russian war and the CIA involvement over there and it will all start to make sense.

This is why friends of the Saudi Arabian rulers are funding Al-Qaeda. It's why the US isn't surprised by this information, it happened before.

Paper is not secure

[thisisauniqueid]

> 'words on paper can be made secure, electronic archives not.'
What about the Pentagon Papers? They were photocopied. Thousands of pages.

Re:tomhudson is a lot of talk, he can't do it thou

[uninformedLuddite]

Tell us how you really feel. I think he sounds cute

Re:That's not the classified guidelines I worked w

[uninformedLuddite]

The most deadly words for an engineer. 'I have an idea.

The most depressing words for a programmer. "It's just a minor modification and can you make it blue?"

Open tools for nutritional research example

[Paul Fernhout]

Thanks for the reply. You make a lot of good points. Still, the availability of such tools might help more people in the general public develop better analytical skills and learn more about context for various issues, so, the fact that most of the public could not make great use of such tools now does not mean they might not change that by their availability, or that the few who could use such tools might not use them to good advantage in all sorts of areas, building on tax-funded research.

Consider, what would it be like to apply this to, say, medical information research information, first?

Here is derived from something I just posted to a (private) forum on Dr. Fuhrman's site ( http://drfuhrman.com/ ), in reply to something he wrote including a mention of limited time (in a reply to some posts I made about vitamin D issues). You can think of what I suggest here as an example of how the same sorts of tools created for intelligence analysts might be very useful in other contexts. I just joined that forum a couple of days ago (there was an offer for a free six weeks, since expired), but I feel a bit frustrated to be writing stuff that gets stuck behind paywalls (same as when I post to private mailing lists), so it is probably not a place I will keep up with that much. (I'm not necessarily opposed to private-seeming spaces for people to discuss medical issues, but it is sad to think of all the information lost from them to general knowledge. There is also potentially the issue of financial obesity being as serious a problem as physical obesity. :-)

=== Better open tools for nutritional research communities

Dr. Fuhrman, thanks for the reply, and thanks for creating so many great resources and helping so many people, including me and my family.

[Comments snipped on vitamin D issues, linking to: http://www.grassrootshealth.net/recommendation ]

On having time for combing through the conflicting medical literature and conflicting models, I might suggest that addressing that issue with better tools may be even more important than doing more nutritional studies with the Nutritional Research Project [that Dr. Fuhrman is involved in http://www.nutritionalresearch.org/ ]. Sometimes we don't know what we know. :-)

Basically, in your mind you were able to integrate all these studies leading up to your books. How can you make it possible for everyone to look at the literature and come to similar conclusions for themselves, in an open way?

One possibility is with structured arguments about health topics, and also including a way people could look at the information from multiple perspectives, and so on. This vitamin D issue is an obvious starter issue, but there are many others where, without necessarily taking sides, one could encourage free form discussions like in these member forums, as well as more structured ones, and somehow have the result be like a Wikipedia of progressive medicine. Wikipedia is not the right model, but I mention it as it is well known, and it is a success to some degree, even with a lot of controversy.

Here are some other examples from SRI (my wife helped a bit with them).

From:
http://www.ai.sri.com/~seas/
"EAS is a software tool developed for intelligence analysts that records analytic reasoning and methods, that supports collaborative analysis across contemporary and historical situations and analysts and has broad applicability beyond intelligence analysis."

From:
http://www.ai.sri.com/~angler/
"Angler is a tool that helps intelligence/policy professionals Explore, understand, and overcome cognitive biases, and Collaboratively expand their joint cognitive vision Through use of divergent & convergent thinking techniques (such as brainstorming and clusterin

On turning enemies into friends

[Paul Fernhout]

Thanks for reporting me! :-)

My rationale for that:
    http://groups.google.com/group/openmanufacturing/msg/ae28e8971f8f9669?hl=en
"Maybe I'm trying to make the OM list the post-scarcity social consciousness raising equivalent for global intelligence analysts of "The Funniest Joke In the World"? ... Although, obviously, that is a metaphor, and my objective is analysts being reborn mentally as post-scarcity beings instead of any dying physically as depicted in that comedy sketch. The best way to deal with potential enemies is to make them into friends, a strategy idea lost on the previous US administration. That is why the USA has so many more enemies than it used to have compared to the 9/11 days of "We are all Americans"..."

I may be going down someday from some random martinet unwilling to understand about intrinsic security or mutual security or true patriotism, but I hope the message in my email sig will continue to spread, and the world will someday be a better place for all our children and relatives and friends and so on across the globe. :-)
    http://www.blessedunrest.com/

And along the way, I hope more potential enemies will be turned into friends, just like Tadodaho eventually combed the snakes from his hair in the Haudenosaunee (Iroquois) story:
        http://www.pdfernhout.net/on-dealing-with-social-hurricanes.html

My sig had to be shortened for slashdot; the longer version is: "The biggest challenge of the 21st century is the irony of technologies of abundance in the hands of those thinking in terms of scarcity."

Which then implies, eventually:
    http://www.pdfernhout.net/recognizing-irony-is-a-key-to-transcending-militarism.html
    http://knol.google.com/k/paul-d-fernhout/beyond-a-jobless-recovery#Four_long(2D)term_heterodox_alternatives

Electronic hacks

[Firethorn]

I'm going to have to be careful here.

I think they're going to go towards thin-clients. Which means that you won't be directly putting your leak into 'encoded' format for taking out of the workcenter, because even if you have a printer(and those are going away in a lot of places), you won't have the software to do the encoding. Plus, cell phones are already forbidden around classified workstations.

Basically, the 'new' security model is going to end up that to 'leak' documentation you're either going to have to hand write it or sneak in an active digital device like a camera, and even then be restricted to taking pictures one screen at a time. In an area where you're subject to random searches and aren't supposed to have any personal electronics anyways.

Re:This is NOT about "intel"

[dcw3]

This kind of post is why we need to be able to mark items as Naive. Seriously, let us know when you're back from Oz, Utopia, or whatever other trip you're on, so you can hold a logical discussion.

More on turning enemies into friends...

[Paul Fernhout]

http://www.bullies2buddies.com/

Re:Intel

[neminem]

Well, you're one of at least 4 (you, two other people who also made jokes about Intel on the first page, since I believe it's tradition to only read the first page, and me.)

I definitely wondered from the headline what danger Intel sharing information could possibly have (making computers more open to hardware-based viruses, perhaps?)

Ummm... kay...

[Stick32]

Correct me if I'm wrong... but didn't the guy who linked the documents to wikileaks do so by comping the files to a CDR/RW disc?

This is a truely flawed view of the problem

[WindShadow]

The problem is not the media, but the access to data. Given the breadth of the information topics, no one below cabinet level should have been able to see it all, much less some low level clerk. This was a failure of the need to know policy, and the attempt to blame wikileaks or the clerk for the release is clearly an attempt to disguise the failure of method. I covered the technology and ethical issues at length in a blog post when it happened.

I have held DoD and DoE clearance, and have worked with information control for companies like GE and SBC (now at&t)

Two Person Rule

[StikyPad]

The two person rule is common for handling of classified material, but it's only as good as the people involved. After a break-in period, people generally become comfortable with each other and don't typically feel the need to scrutinize each other's activities. Indeed, continuing to scrutinize the activity of an otherwise trusted individual can be taken as an insult, lead to lower job satisfaction, etc. Rotations or random pairing can mitigate this somewhat, but it doesn't preclude two trusting individuals from ever pairing, nor does it prevent collusion. In short, it sounds good in theory, but without accounting for apathy and the tedium of routine, it's far from a panacea.

I've attended many IA briefings, both as a civilian and as active duty, and it's no exaggeration to say that these kinds of policies are met with ridicule and/or contempt by people who actually have the duty of carrying them out, and that the presenters are even apologetic for the hoops that everyone has to jump through. Everyone in the room knows that people do the best they can, and sometimes shit happens, but the theory of perpetual vigilance only works in movies and on TV. Humans simply aren't wired for paying close attention to "nothing happening" for any extended period of time, even if it's two hours a day once a week. It's exactly the principle that law enforcement uses to its advantage in fugitive recovery -- it only takes one slip-up for the whole thing to come crashing down.

I'm not saying that reasonable efforts at counterintelligence shouldn't be maintained; I'm only saying that expectations of perfection are unreasonable, and will never be met. There is no single policy or group of policies taken together that will prevent the next leak; at best they will delay it.

Re:The need for FOSS intelligence tools (example)

[Paul Fernhout]

Just came across:
http://www.phibetaiota.net/
http://en.wikipedia.org/wiki/Robert_David_Steele

Now that I think of it, I think I have seen something by him somewhere before... Maybe the idea lodged in my unconscious?