NSA: Others Implicated in Making Snowden Data Leaks Possible

← Back to Stories (view on slashdot.org)

NSA: Others Implicated in Making Snowden Data Leaks Possible

Posted by timothy on Thursday February 13, 2014 @04:30AM from the who's-leaking-on-what? dept.

NBC News reports that "A civilian NSA employee recently resigned after being stripped of his security clearance for allowing former agency contractor Edward Snowden to use his personal log-in credentials to access classified information, according to an agency memo obtained by NBC News. In addition, an active duty member of the U.S. military and a contractor have been barred from accessing National Security Agency facilities after they were 'implicated' in actions that may have aided Snowden, the memo states. Their status is now being reviewed by their employers, the memo says." You can read the memo for yourself.

118 comments

Min score:

Reason:

Sort:

D'oh! by Anonymous Coward · 2014-02-13 04:34 · Score: -1

Why in the world would you let someone use YOUR OWN PERSONAL login credentials? Why not just give him a key that you can lock out after he's done his work. I cannot believe that someone was deliberately this stupid
1. Re:D'oh! by Anonymous Coward · 2014-02-13 04:42 · Score: 1
  
  Don't field many gov't contracts, I take it?
2. Re:D'oh! by Anonymous Coward · 2014-02-13 04:46 · Score: 2, Insightful
  
  Why in the world would you let someone use YOUR OWN PERSONAL login credentials? Why not just give him a key that you can lock out after he's done his work. I cannot believe that someone was deliberately this stupid
  So Snowden social hacked a couple of people into allowing him to use their login credentials. That isn't exactly big news and while I'm not saying it's a particularly smart thing to do I seriously doubt that these people are the only ones in NSA history to share login credentials. The real news is that now that the US authorities can't get Snowden they are going to do the next best thing which is to hang these people out to dry as accomplices. I believe that's a mistake since don't think that the vindictiveness of the Obama administration and the US security apparatus is going to do them any favours in the long run but at least it is in the very best traditions of American 'come down on them like a ton-of-bricks' justice.
3. Re:D'oh! by Anonymous Coward · 2014-02-13 04:52 · Score: 0
  
  or was it the jedi mind trick.
4. Re:D'oh! by Anonymous Coward · 2014-02-13 04:54 · Score: 5, Insightful
  
  It's not vindictiveness -- it's procedure. Anyone with a TS-SCI clearance gets the "we'll ruin your life if you screw up" speech when they accept the status. And, given how often you're required to review training on how not to screw up, these people have zero room to complain about any proverbial ton of bricks.
5. Re:D'oh! by MightyMartian · 2014-02-13 04:58 · Score: 4, Informative
  
  Apart from the fact that I'm glad the leaks happened, it betrays an extraordinary amount of stupidity on the part of those who gave Snowden their credentials and indicates, at least to me, a considerable lack of training.
  The company I run has some government contracts dealing with a considerable amount of very personal and detailed information of unemployed and disabled persons. I can tell you right now that we regularly drum into everyone's heads the level of confidentiality we require, that under no circumstances are you to give someone your IDs and passwords, or let them use your workstation while you're logged in. Every access to client information is logged, and information is strictly limited to what is needed by each employee to do their job.
  
  --
  The world's burning. Moped Jesus spotted on I50. Details at 11.
6. Re:D'oh! by ganjadude · 2014-02-13 05:00 · Score: 2
  
  If I had to guess, They wanted him to do what he did.At least I would like to believe anyway that he wasnt the only one sick of unconstitutional acts
  
  --
  have you seen my sig? there are many others like it but none that are the same
7. Re: D'oh! by Anonymous Coward · 2014-02-13 05:03 · Score: -1
  
  wow your a real hot shot, it must be cool to have such a secret super important job containi g addrwsses of *unemployed people*.
8. Re:D'oh! by Kookus · 2014-02-13 05:09 · Score: 2
  
  When access to resources is a difficult or lengthy process, and deadlines for products using those resources don't take that into consideration, then it is easier to hand over your credentials.
  If the processes for gaining access were streamlines and efficient, then this wouldn't occur. Since it probably is not streamlines and efficient, this is what you get.
9. Re:D'oh! by boristdog · 2014-02-13 05:11 · Score: 5, Interesting
  
  I guarantee you Snowden really did no "social hacking" at all.
  If you have EVER been someone who solves people's computer problems (sysadmin, DT support, phone support, etc.) you know that LOTS of people will just flat out tell you their passwords when they contact you. They'll put their passwords on post-its, in e-mails, even in the trouble ticket itself. Or they'll just tell you on the phone or in person. No matter how you try to tell them "I don't want or need that information" they still do it. Upper management and C-levels are the worst about doing this, and their accounts can usually access anything in the organization.
  Hell, I don't even do support any more, but people still leave me notes or tell me their passwords if they want me to help them with something IT won't do.
10. Re:D'oh! by Hamsterdan · 2014-02-13 05:24 · Score: 1
  
  I used to work for an ISP and *many* customers would call back after we cut off access because we couldn't talk to them would say "But I gave you my login and password already, you asked me by email because you found an incoherence"
  (their account were used to send junk mail via the webmail service).
  Since people are giving away credentals by *email*, not surprising they would give them out in person.
  
  --
  I've got better things to do tonight than die.
11. Re: D'oh! by Anonymous Coward · 2014-02-13 05:31 · Score: 0
  
  That's digital gold. A hacker redirects a few thousand unemployment checks, and they're rolling in dough.
12. Re:D'oh! by dcollins117 · 2014-02-13 05:35 · Score: 3, Funny
  
  I can tell you right now that we regularly drum into everyone's heads the level of confidentiality we require, that under no circumstances are you to give someone your IDs and passwords, or let them use your workstation while you're logged in. Every access to client information is logged, and information is strictly limited to what is needed by each employee to do their job.
  You should contract work for the NSA. Apparently, they need someone with your expertise.
13. Re:D'oh! by Stormy+Dragon · 2014-02-13 05:40 · Score: 2
  
  I can tell you right now that we regularly drum into everyone's heads the level of confidentiality we require, that under no circumstances are you to give someone your IDs and passwords, or let them use your workstation while you're logged in.
  And I can tell you right now that unless you're a tiny operation, people are doing it anyways.
14. Re:D'oh! by Anonymous Coward · 2014-02-13 05:43 · Score: 0
  
  There's nothing extraordinary about it at all, and if you have more than a handful of people at your company I'll bet it still happens despite the training, just less often.
  Some people just like sharing and being helpful, and don't attach any special significance to that thing you type in to get the computer to work.
15. Re:D'oh! by adolf · 2014-02-13 05:54 · Score: 1
  
  The company I work for the IT folks keep a complete list of usernames and passwords in a text file, stored on a machine open to the Internet (including FTP!) which is, itself, is "protected" by those same passwords.
  Oh, but it's OK, they told me once: It's in a password-protected zip file, so it's safe.
  I'm sure that the unencrypted plaintext is scattered all over the temp directory of every machine they've ever used to view this file.
  I'm (very) glad I don't get paid to care about that network anymore.
  
  --
  Kid-proof tablet..
16. Re:D'oh! by noh8rz10 · 2014-02-13 06:04 · Score: 1
  
  Yeah, these people are effed in the butt. Obama can't hang snowmen so he,ll go after this lot instead.
17. Re:D'oh! by Khashishi · 2014-02-13 06:30 · Score: 1
  
  I certainly hope that NSA contractors are a little better than your run-of-the-mill company in terms of security.
18. Re:D'oh! by davester666 · 2014-02-13 06:42 · Score: 5, Informative
  
  Yes it is. The people looking up their girlfriends info and obviously violating FISA warrants don't get fired. The ones sending information to the FBI with "don't tell anybody we are doing this and make sure to claim your "investigation" started with some other evidence don't get fired.
  
  --
  Sleep your way to a whiter smile...date a dentist!
19. Re:D'oh! by coolsnowmen · 2014-02-13 06:52 · Score: 1
  
  Just a tip, if a cute person leaves you a sticky note saying, "meetMeAfterWork!"...that might NOT be their password"
20. Re:D'oh! by Gr8Apes · 2014-02-13 07:06 · Score: 2
  
  I certainly hope that NSA contractors are a little better than your run-of-the-mill company in terms of security.
  Hate to break it to you....
  
  --
  The cesspool just got a check and balance.
21. Re:D'oh! by Anonymous Coward · 2014-02-13 07:15 · Score: 1, Insightful
  
  No, it isn't. If Snowden wanted to make a point, he would have only released information pertinent to the Fourth Amendment. Instead, he did a data dump that pretty much showed the extent to which the NSA spies on foreigners, which is their fucking job.
  If the enabled the latter half of the above sentence, then they're quite burnable.
22. Re:D'oh! by davester666 · 2014-02-13 07:24 · Score: 4, Insightful
  
  then why the fuck hasn't the people in the NSA who have been targeting American's [namely " The people looking up their girlfriends info" and "obviously violating FISA warrants" and "the ones sending information to the FBI with "don't tell anybody we are doing this and make sure to claim your "investigation" started with some other evidence", which CLEARLY violates the law don't face similar punishments?
  Or is it just a pick and choose method of law enforcement.
  And don't get me started on the whole "it's an emergency, no need to follow procedure anymore".
  
  --
  Sleep your way to a whiter smile...date a dentist!
23. Re:D'oh! by Anonymous Coward · 2014-02-13 07:27 · Score: 0
  
  I guarantee you Snowden really did no "social hacking" at all.
  If you have EVER been someone who solves people's computer problems (sysadmin, DT support, phone support, etc.) you know that LOTS of people will just flat out tell you their passwords when they contact you. They'll put their passwords on post-its, in e-mails, even in the trouble ticket itself. Or they'll just tell you on the phone or in person. No matter how you try to tell them "I don't want or need that information" they still do it. Upper management and C-levels are the worst about doing this, and their accounts can usually access anything in the organization.
  Hell, I don't even do support any more, but people still leave me notes or tell me their passwords if they want me to help them with something IT won't do.
  Yeah, but this is the NSA. I'd expect better of them.
24. Re:D'oh! by MightyMartian · 2014-02-13 07:53 · Score: 1
  
  There's not much expertise in saying "You will be fired... and worse." We make it very clear that violation of both government privacy rules and company policies could very well invite legal proceedings.
  
  --
  The world's burning. Moped Jesus spotted on I50. Details at 11.
25. Re:D'oh! by Anonymous Coward · 2014-02-13 08:19 · Score: 2, Interesting
  
  The failing startup I was stuck at for a few years eventually hired some expensive ex-NSA security company to spy on us. I won't go into the reasons why, but it was purely political, and an empty gesture to satisfy some of our more vocal/deluded shareholders. You can imagine what it does to morale to have someone being paid at least twice your salary to monitor you, but I digress.
  The point is, they went around one day, asked us each for our password(s), and then wrote them down on a legal pad. When it was my turn, they were impressed because I had the only password in the entire company that wasn't trivially crackable and, to prove it, showed me the legal pad with everyone's passwords on it.
  I really hope that they were trying to set me up into using someone else's login (which of course I wouldn't), and that they weren't actually that stupid. I respect malice over incompetence, but I suspect that in reality they were just that incompetent.
  Posting anonymously out of paranoia. I don't think the company even exists anymore, but whatever.
26. Re:D'oh! by boristdog · 2014-02-13 08:27 · Score: 1
  
  I worked in Gov't IT for 8 years. Employees were constantly drilled about protecting sensitive information.
  Same kind of thing happened all the time. Passwords on post-its, in e-mail, etc. People are still people even if they work for the government.
27. Re:D'oh! by Anonymous Coward · 2014-02-13 08:36 · Score: 1
  
  which CLEARLY violates the law don't face similar punishments?
  Because it isn't CLEAR that any laws were broken. People around here like to point to some advisory board report that said the activities were probably illegal, but that 5-person board was split 3-2 so you can't say that CLEARLY the activities were illegal. It is CLEAR to you because that is what you believe it to be, but (fortunately) the US legal system isn't beholden to what you specifically believe.
28. Re:D'oh! by Anonymous Coward · 2014-02-13 08:44 · Score: 0
  
  I think this is exactly pick and choose law enforcement.
  Law enforcement can choose not to enforce a law. They risk having their budgets cut or regulated to all hell if they ignore the regulators, but the current law enforcers don't have that fear since they have a do nothing regulating body watching over them.
29. Re:D'oh! by Anonymous Coward · 2014-02-13 08:45 · Score: 1
  
  Not at the TS level. You'd get your balls busted if you gave out your password or put it up on a sticky note. They take that shit VERY seriously. Not only were these guys not supposed to let them use their credentials, which is a HUGE no-no to begin with, but by training they should have filed a security incident report if Snowden asked them if he could use their login. They most certainly get busted for this. They are the reason that people with clearances have to complete so many annual security refreshers.
30. Re:D'oh! by fredprado · 2014-02-13 08:52 · Score: 1
  
  Sure, but whoever does it will have to deal with the consequences and no excuse will save them.
31. Re:D'oh! by Anonymous Coward · 2014-02-13 08:52 · Score: 0
  
  I've never had to work on anything that was really confidential but I had hoped that the security for those that do would be better than "you're fired" if you share your credentials. Most people share their credentials because it's simply so much more efficient. Who wants to wait days for someone to get clearance so they can do something they need to do in 5 minutes. Until you fix that problem, no amount of training or threats in the world will fix human nature.
32. Re:D'oh! by Anonymous Coward · 2014-02-13 09:02 · Score: 3, Insightful
  
  which CLEARLY violates the law don't face similar punishments?
  Because it isn't CLEAR that any laws were broken. People around here like to point to some advisory board report that said the activities were probably illegal, but that 5-person board was split 3-2 so you can't say that CLEARLY the activities were illegal. It is CLEAR to you because that is what you believe it to be, but (fortunately) the US legal system isn't beholden to what you specifically believe.
  Ah, sorry, but the fourth Amendment is pretty fucking CLEAR. Argue all you want about FISA panels and other such bullshit we've legalized in the last decade to completely fucking derail that Right, but it is VERY fucking CLEAR what laws have been broken and by whom here if you're willing to dilute the issue down to the very basics where it belongs. It's this bullshit dissection of these kinds of violations that allows you and everyone else to not see the fucking elephant in the room CLEAR as day. An "investigation" is opened, and results are published about 6 months after the last person stopped giving a shit about any of it. And then the illegal activity continues, just as it will here.
  Knowing where the violations are, and having the power to do fuck-all about it, are worlds apart. This is why we all know they're breaking laws, and yet not a fucking thing has changed to stop it. If any concept is CLEAR here, that one is.
33. Re:D'oh! by Anonymous Coward · 2014-02-13 09:04 · Score: 0
  
  There's not much expertise in saying "You will be fired... and worse." We make it very clear that violation of both government privacy rules and company policies could very well invite legal proceedings.
  Yeah, and Snowden probably thought the whistleblower laws were "very clear" at one point too. So much for that shit. Obviously any law can be bent around to fuck you in the ass if they want to label you a criminal bad enough.
34. Re:D'oh! by davester666 · 2014-02-13 09:09 · Score: 5, Insightful
  
  unless every single LOVEINT target was not a US citizen, the law was broken [as the NSA isn't permitted by law to spy on US citizens]
  and a FISA judge [he should know] said the NSA violated his warrant for YEARS.
  How more illegal do you need to get?
  
  --
  Sleep your way to a whiter smile...date a dentist!
35. Re:D'oh! by Anonymous Coward · 2014-02-13 09:21 · Score: 0
  
  Beyond the obvious sheer stupidity you called out, unless they are using modern extensions to the zip password format, the password protection will be laughably easy to break.
  See:
  http://link.springer.com/chapter/10.1007%2F3-540-60590-8_12
  Observe that it took only a few hours, and that was years ago.
36. Re:D'oh! by poetmatt · 2014-02-13 09:33 · Score: 1
  
  This is hilarious. You think there's some company that doesn't say you're fucked if you give out your information? It's just legal boilerplate. That doesn't mean it's enforceable.
  The fact that they're restricting access that was easily and openly given out before is just a slow attempt to cover up the barn door which has been left open. It's pretty funny, to be quite honest.
37. Re:D'oh! by mjwalshe · 2014-02-13 09:36 · Score: 1
  
  The lloveint cases where new hires and got found out pretty much immediately - presumably the usual suspects will be publishing how many Googlers , yahoo apple and phone company employees have accessed things they should have not.(looking up the presidents private phone number medical records etc)
  
  Best practice is to have phone company employees with with wide access to the systems access pass TS (DV in the UK) clearance.
38. Re:D'oh! by Rich0 · 2014-02-13 10:15 · Score: 1
  
  Well, it probably is enforceable in most cases, but that doesn't mean it doesn't happen all the time anyway. If people actually followed corporate policies there would be very little successful social engineering.
  My workplace has a sign up that it is against policy to bring a cell phone camera onto the site. Probably every employee from the CEO to the janitor violates this policy.
39. Re:D'oh! by Stormy+Dragon · 2014-02-13 11:04 · Score: 1
  
  Which is the same as the case here with the NSA
40. Re:D'oh! by Anonymous Coward · 2014-02-13 14:14 · Score: 0
  
  thats still vindictiveness you know
41. Re:D'oh! by Loki_1929 · 2014-02-13 16:46 · Score: 1
  
  When a new employee comes on board and needs their access set up, who does that? When someone needs their access expanded, who handles that? How do you control their access?
  From what I understand, that was the problem with Snowden and the credentials he had/obtained access to: they had essentially superuser access over the system. In any system, you need people at the top who can manage it. If those people decide to betray trust, you're SOL.
  
  --
  -- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
42. Re:D'oh! by Anonymous Coward · 2014-02-13 17:22 · Score: 0
  
  Actually their "fucking job" is to protect national security.
  Spying on foreign corporations that compete with American companies in order to share trade secrets or get ahead on a big sale is not national security related. Spying on a staunch ally like German (Merkel's cell phone) is not in our national security interests either. Spying on the conversations of foreign leaders ahead of a summit in order to study and respond to their talking points ahead of time is not in our national security interests.
43. Re:D'oh! by david_thornley · 2014-02-14 04:55 · Score: 1
  
  No, actually, it isn't clear. The Fourth Amendment forbids unreasonable search and seizure. What's "reasonable"? People are supposed to be secure in their persons, houses, papers, and effects. Does this protect records of who you've phoned or emailed? The Supreme Court has ruled that similar things are legitimate observation. If an agency collects copies of your papers, without your knowledge, and takes steps to make sure they will not be accessed unreasonably, are you now insecure in your papers?
  Don't just answer these questions; explain why your answers are clearly correct. The NSA has largely been operating according to the law as it sees it (LOVEINT and similar employee abuses don't count here, since they're private illegalities, same with individuals lying to Congress). I don't necessarily agree with their interpretations, and I do think several laws should be changed, but I don't see NSA actions that are obviously illegal.
  
  --
  "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
44. Re:D'oh! by Anonymous Coward · 2014-02-14 08:07 · Score: 0
  
  Documents Leak.
  A medical form filled out by me (with a brain injury and painkillers) and sent to my state disability office was leaked to my state . Result from unemployment was a criminal claim, demand for "claw-back," and being banned from both unemployment and disability. It is my understanding that sharing of such information is a major HIPAA violation. I have the admitting such somewhere round here....
  This turned an honest and minor error, fixable with a phone call, into an eight-month ordeal of fear, malnutrition, and foreclosure-level poverty.
No hardware access tokens? by hawguy · 2014-02-13 04:37 · Score: 4, Interesting

The NSA, the "experts" in computer security, doesn't use hardware access tokens? Everyone knows that passwords can be compromised (and a PKI certificate adds little since an attacker could copy the cert).
Though I guess since the NSA already hacked RSA, they knew they couldn't trust RSA tokens.
1. Re:No hardware access tokens? by Anonymous Coward · 2014-02-13 04:49 · Score: 0
  
  The Chinese hacked RSA
2. Re:No hardware access tokens? by jafac · 2014-02-13 05:11 · Score: 5, Informative
  
  HSPD-12 says that since 2006, they are REQUIRED (**SHALL**) to use them.
  Doesn't mean they do. Just sayin'.
  
  --
  
  These are my friends, See how they glisten. See this one shine, how he smiles in the light.
3. Re:No hardware access tokens? by Anonymous Coward · 2014-02-13 05:43 · Score: 2, Funny
  
  Am I missing something, or are they hiring a Fortran pre-processor as a body of workers?
4. Re:No hardware access tokens? by lennier · 2014-02-13 13:28 · Score: 1
  
  This is the type of government organization that hires groups like RATFOR as security consultants.
  They outsourced security to a Fortran 66 preprocessor? Well that explains why my Linksys router is currently trying to crack Minuteman silo launch codes.
  
  --
  You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
5. Re:No hardware access tokens? by JamieIanMacgregor · 2014-02-13 15:14 · Score: 1
  
  pssst, tell your router it's 00000000 http://news.slashdot.org/story...
AKA: We're gonna punish somebody by Anonymous Coward · 2014-02-13 04:37 · Score: 1

We can't let folks think that they could get away with this, of course.
1. Re:AKA: We're gonna punish somebody by canadiannomad · 2014-02-13 04:41 · Score: 2
  
  This was my immediate thought too....
  
  --
  Hmm, the humour and sarcasm seem to have been be lost on you.
2. Re:AKA: We're gonna punish somebody by FriendlyLurker · 2014-02-13 05:21 · Score: 5, Insightful
  
  My immediate thought was: They fire, Investigate and prosecute everyone involved except those in power that systematically broke our laws on a massive scale and violated our constitution. If ever there was an example of how far we have sunk into a corporate fascist dictatorship hiding behind words like "freedom", "democracy", then this must be it.
3. Re:AKA: We're gonna punish somebody by Anonymous Coward · 2014-02-13 09:05 · Score: -1
  
  Specifically, what laws are you talking about that were broken? And don't just flail your arms around and cry 4th Amendment like some bible thumper who pulls out some passage as proof that God hates gays. And also, don't pull out the much ballyhooed advisory panel report, because that august panel of five were split 3-2 on whether any activity was illegal (or if you want to use that as evidence, you have to at least acknowledge that it is not "clear" or "obvious" that many around here like to say). I would think much more of your kind of sophomoric comments if they could actually be backed up by SOMETHING. In your favor I'll admit that it is a great karma whoring argument.
4. Re:AKA: We're gonna punish somebody by Rich0 · 2014-02-13 10:17 · Score: 1
  
  Specifically, what laws are you talking about that were broken?
  Uh, the 4th amendment? And if they didn't break any laws it represents a defect in the laws more than anything else.
5. Re:AKA: We're gonna punish somebody by david_thornley · 2014-02-14 05:05 · Score: 1
  
  Specifically show us what part of the Fourth Amendment they broke. It isn't clear. You're secure in your person, house, papers, and effects from unreasonable search and seizure. Fine. What's "unreasonable" in this case (and there are legitimate national security issues involved)? What about observing things you cause to have done outside your house? Are the records of your phone calls and emails, not including content, "papers" or "effects" or something else?
  I will agree that the laws are defective here, but it isn't obvious to me that the NSA as an organization is breaking them.
  
  --
  "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Snowden did not act alone by mbone · 2014-02-13 04:42 · Score: 5, Interesting

It has been obvious to me for a while that Snowden did not act alone, and that he probably represents a surface manifestation of deep divisions within the intelligence community.
1. Re:Snowden did not act alone by marcello_dl · 2014-02-13 04:58 · Score: 4, Interesting
  
  Given that a lot of people in intelligence communities believe they are working for the good side, I have no troubles believing your hypothesis.
  Anyway, when a guy leaks about possibly corrupt institutions, and the reaction is on the guy and possible accomplices, don't we have a bigger problem? It means justice is in bed with corrupt institutions.
  
  --
  ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
2. Re:Snowden did not act alone by Chas · 2014-02-13 05:02 · Score: 3, Informative
  
  It means justice is in bed with corrupt institutions.
  No. It means that justice is dead and the corrupt institutions have a penchant for necrophilia and buggery.
  
  --
  
  Chas - The one, the only.
  THANK GOD!!!
3. Re:Snowden did not act alone by ZouPrime · 2014-02-13 06:08 · Score: 4, Interesting
  
  > Given that a lot of people in intelligence communities believe they are working for the good side, I have no troubles believing your hypothesis.
  A truckload of people in the security and intelligence communities have issues with domestic surveillance and were against the Patriot Act from the very begining. It's far from a minority opinion.
4. Re:Snowden did not act alone by Khashishi · 2014-02-13 06:32 · Score: 1
  
  Hmm, I got the impression that he did act alone. In his interviews, he stated that he knew if he didn't act, nobody else would.
5. Re:Snowden did not act alone by Vitriol+Angst · 2014-02-13 06:49 · Score: 1
  
  Unbeknownst to many in our "Security USA Hell Yeah! Inc." there may be real heroes hidden behind those made in China flag pins.
  
  --
  >>"ad space available -- low rates!!!"
6. Re:Snowden did not act alone by s.petry · 2014-02-13 08:53 · Score: 4, Interesting
  
  The Feb. 10 memo was signed by Ethan Bauman, the NSA’s director of legislative affairs. It was sent to the congressional committees after repeated questions from senior members about whether the NSA intended to hold any of its employees accountable for the security lapses that enable Snowden to gain access to massive volumes of classified documents that he later leaked to the news media.
  “Has anybody been disciplined at NSA for dropping the ball so badly?” Senate Judiciary Committee Chairman Sen. Patrick Leahy, D-Vt., demanded of NSA Director Gen. Keith Alexander at a Dec. 11 hearing. Alexander at the time replied that the agency had three “cases” that “we’re currently reviewing.” (An NSA spokeswoman Vanee Vines declined comment Wednesday night, writing in an email: “I don’t have anything for your story.”)
  They don't want to stop spying and shitting on personal liberties, they want people held accountable for giving a whistle blower access to data. TFA is of course a piece of government run propaganda^W^W^Wshit, who never does real journalism. They simply repeat the "kill the messenger" message these hearings bring out from the people holding government offices. A real journalist asks real questions, and points out truth that should make people uncomfortable if they are doing something wrong.
  Snowden denied claims of "tricking" people or "stealing" long ago. I think the more likely collaboration was people sympathetic to his cause who gave access and pointed at things. This means they are not jailed as being whistle blowers, because.. well there is a history of (especially this administration) punishing whistle blowers.
  What does TFA and the message boil down to? Easy, more "kill the whistle blowers" message and more "fuck the citizens" messages. Not one lick of journalism of course, just more repeated propaganda.
  
  --
  -The wise argue that there are few absolutes, the fool argues that there are no probabilities.
7. Re:Snowden did not act alone by skribe · 2014-02-13 13:08 · Score: 1
  
  Everyone believes they are working on the good side. Even Hitler and his cronies believed they were doing good by eliminating the Jews, Romany, homosexuals and others. The road to hell is paved with good intentions.
  
  --
  Blog
8. Re:Snowden did not act alone by Anonymous Coward · 2014-02-14 05:56 · Score: 0
  
  A truckload of people in the security and intelligence communities have issues with domestic surveillance and were against the Patriot Act from the very begining. It's far from a minority opinion.
  Not everybody treats the Nuremberg Precedent (which IS applicable to the US legal system, as a right retained by the people under the 9th Amendment) with contempt. The US legal profession, as a rule, DOES treat it with contempt -- it is in their interests to do so, a messed up legal system creates a demand for their services and hence there is a huge ethics problem here, a point that has been discussed numerous times on Slashdot -- but there are exceptions even within that profession.
  The Patriot Act IS illegal. Under Nuremberg, that creates an individual responsibility to refuse to implement it. Under Nuremberg, both Laws and Precedents that support this law are illegal. as are Executive and Judicial Orders, or policies of government agencies, that attempt to implement the law.
  We would expect military, police, and legal personnel to refuse to commit atrocities or put people in concentration camps, irregardless of the laws or precedents that told them it was "OK".
  Similarly, we expect these people to refuse to implement laws and policies that violate fundamental rights, irregardless of what the courts, or their superiors, or their legal advisers might tell them. This is the lesson of Nuremberg.
  Within the military and intelligence services, there are a significant number of people that understand this. Few of them hold executive positions.
  As so often seems to be the case, many of the lawyers and executives involved lack integrity, but quite a few of the ordinary people know perfectly well that what is going on is wrong and don't want anything to do with it (or are even willing to fight against it, at the risk of being labelled criminals or traitors).
  A strong parallel can be drawn between the events here, and what happens when companies deliberately harm the environment. There, as here, lots of people who end up in executive positions or in the supporting legal staffs lack integrity and do things that they should have known (and probably do know) were wrong. There's always some dumb people that will implement these policies.
  Indeed, the current situation can be viewed as a form of pollution, not of the natural environment, but rather of the legal environment. Laws and Precedents that infringe fundamental rights or create an artificial demand for the services of legal professionals, ARE contaminants in the legal environment.
9. Re:Snowden did not act alone by Anonymous Coward · 2014-02-14 07:41 · Score: 0
  
  I filed a whistleblower report at the federal level.
  I have a PhD and an engineering degree, but am currently on food stamps.
  Oh yeah, and trying to get on disability because of an attempt on my life left me with brain damage.
The witch hunt continues by Anonymous Coward · 2014-02-13 04:44 · Score: 0

"It's a conspiracy! It goes all the way to the top!"
I wonder - was it social engineering? by blackwizard · 2014-02-13 04:45 · Score: 5, Interesting

I can easily imagine a situation where he calls up someone with access to classified info, and says something like, "this is Snowden from IT; we're having problems restoring the backup of your encrypted data files on such-and-such server; can you loan me your login information so we can properly validate the checksums? You can change your password right afterward."
1. Re:I wonder - was it social engineering? by gstoddart · 2014-02-13 04:58 · Score: 5, Informative
  
  It has already been revealed he did stuff like that.
  But at an agency which is supposed to be secretive and paranoid -- if you have people falling for that, they're really not qualified to be working in that kind of environment.
  Every few months my company sends out test emails to check for phishing, people's likelihood to click on spam, or chance of falling for social engineering. If you fail, you get sent to remedial data security training. If you repeatedly fail, they might decide you can't really be trusted around computers.
  If the NSA has people who are not aware enough of these things to not do it, then they're doing a piss-poor job of training their people. There really is no excuse for people who have access to Top Secret information falling for this kind of thing -- there should never be a situation in which it makes sense to give your password to IT as far as I'm concerned.
  
  --
  Lost at C:>. Found at C.
2. Re:I wonder - was it social engineering? by Anonymous Coward · 2014-02-13 05:02 · Score: 0
  
  OK. I don't work in super secret _anything_ but if a coworker asked to "borrow my login" for any purpose whatsoever I'd give him/her/it the hairy eyeball.
  Seriously, anyone who fell for this in a corporate environment should be sent to re-education camp. Anyone who fell for this in a national security environment should be promptly fired (along with whoever hired them, and whatever manager didn't figure out that they were a moron before handing them the keys to the kingdom)
3. Re:I wonder - was it social engineering? by Anonymous Coward · 2014-02-13 05:04 · Score: 3, Insightful
  
  It doesn't take much to breach security when you can exploit peoples' ignorance, especially when it comes to complex matters like PKI. I once worked at a company that provided PKI services to fortune 500 companies. At one point, we asked for a customers' CA certificate to troubleshoot an issue they were seeing. They exported it from the CA in PFX format **INCLUDING THE PRIVATE KEY**!
4. Re:I wonder - was it social engineering? by Anonymous Coward · 2014-02-13 05:06 · Score: 0
  
  yeah but we're talking about an environment where military morons with access to classified data are always coming in and out... not your average tech shop...
5. Re:I wonder - was it social engineering? by Anonymous Coward · 2014-02-13 05:21 · Score: 0
  
  Man, just ask around the people if https is really secure, and why is, or why is not....you will be surprised of the level of ignorance.
6. Re:I wonder - was it social engineering? by X0563511 · 2014-02-13 05:45 · Score: 2
  
  Read the memo. The user entered it themselves, he just manipulated them into doing so on a machine he controlled (eg keylogger)
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
7. Re:I wonder - was it social engineering? by Anonymous Coward · 2014-02-13 09:18 · Score: 0
  
  It has already been revealed he did stuff like that.
  But at an agency which is supposed to be secretive and paranoid -- if you have people falling for that, they're really not qualified to be working in that kind of environment.
  Ah, if you have people that secretive and paranoid working for you, chances are they aren't driving a mouse playing desk jockey. They are the ones in the field doing the actual HUMINT. They are unique individuals.
  I've worked for a lot of "secretive and paranoid" agencies. Doesn't mean I'm some paranoid nutjob, but I do consider myself well-versed in InfoSec.
  There is a difference in an agency mission, and the people behind it. If there were not, then I would consider every single executive working for tobacco companies as nothing more than a mass murderer. Perhaps some do, but it's not exactly an accurate or fair label.
8. Re:I wonder - was it social engineering? by Immerman · 2014-02-14 05:32 · Score: 1
  
  >There is a difference in an agency mission, and the people behind it. If there were not, then I would consider every single executive working for tobacco companies as nothing more than a mass murderer. Perhaps some do, but it's not exactly an accurate or fair label.
  I think the better analogy would be considering every single secretary and production-line worker at tobacco companies a murderer. If you are an executive with a significant voice in deciding the policies and actions of the company then I would argue you absolutely do carry a significant measure of personal responsibility. What's 3% responsibility for 5 million deaths per year come out to in moral terms? Or at least whatever percentage of that 5 million wouldn't have gotten hooked if not for deceptive advertising, addictive additives, and corruption of the FDA. I've got no problem with letting people risk their lives as they see fit, provided they're informed and not intentionally lured into it.
  
  --
  --- Most topics have many sides worth arguing, allow me to take one opposite you.
9. Re:I wonder - was it social engineering? by Immerman · 2014-02-14 06:00 · Score: 1
  
  Even the IT guy when he needs it to fix the problem? I mean come on, you obviously have to give your car keys to the auto mechanic, and you probably care more about your car than some database at work. If you can't trust the guy making everything work, who can you trust? Especially in the heart of the NSA, where even the janitors have had thorough background checks (I would hope).
  Obviously if you are fluent in computer security that (somewhat) falls on it's face, but out in the "real world" that most people are familiar with security is a pretty all-or-nothing, and "nothing" has to be granted from time to time. Not that you wouldn't hope an organization like the NSA would be a little more cautious, but they're seriously fighting human nature here. And frankly, until we find a way of chaining such organizations to the will of the people I'm just as happy knowing they thoroughly riddled with the usual human weaknesses.
  
  --
  --- Most topics have many sides worth arguing, allow me to take one opposite you.
Keylogger, not sharing by tomhath · 2014-02-13 04:54 · Score: 5, Informative

FTFA

“At Snowden’s request,” the civilian NSA employee, who is not identified by name, entered his password onto Snowden’s computer terminal, the memo states.
“Unbeknownst to the civilian, Mr. Snowden was able to capture the password, allowing him even greater access to classified information,” the memo states.
Snowden lied to the other employee in order to steal classified information.
1. Re:Keylogger, not sharing by Anonymous Coward · 2014-02-13 05:12 · Score: 0, Insightful
  
  Steal? As if the NSA had the right to collect this data in the first place. It's OUR data. Snowden just gave it back.
2. Re:Keylogger, not sharing by ganjadude · 2014-02-13 05:15 · Score: 4, Insightful
  
  so, we have an unknown person making claims that his account was stolen with a keylogger. Call me skeptical but I need a little more than an un named employee. Lets hear it from the employee, not the group in the process of doing damage control.
  
  I am not sayign that this is not how snowden got the information, Im just saying I need more proof than the guys who are using unconstitutional secret courts word for it
  
  --
  have you seen my sig? there are many others like it but none that are the same
3. Re:Keylogger, not sharing by Anonymous Coward · 2014-02-13 05:18 · Score: -1
  
  OMG!!!1111!!!!
  Snowden teh badz!
  Wanker.
4. Re:Keylogger, not sharing by MrEricSir · 2014-02-13 05:37 · Score: 1
  
  It's hardly Snowden's fault that his fellow employees were too stupid to follow basic computer security procedures, like not entering their passwords on untrusted systems.
  If these are the kinds of people who work for the NSA, wouldn't you want them kicked out of their jobs ASAP?
  
  --
  There's no -1 for "I don't get it."
5. Re:Keylogger, not sharing by Anonymous Coward · 2014-02-13 05:49 · Score: 0
  
  FTFA
  
  “At Snowden’s request,” the civilian NSA employee, who is not identified by name, entered his password onto Snowden’s computer terminal, the memo states.
  “Unbeknownst to the civilian, Mr. Snowden was able to capture the password, allowing him even greater access to classified information,” the memo states.
  Snowden lied to the other employee in order to steal classified information.
  Not necessarily, he could have just watched the employee not log out and copied information from the employee's account. Often it takes some time to perform the diagnosis for a support task, and seldom does the person requiring assistance have the time or patience to actually watch the work performed.
  In which case, the lie was a lie by omission at best, as in "I fixed your problem (omitted.... and made a copy of everything you had because you were too foolish to watch me do my work)"
  Who knows, perhaps there was even a policy that a backup had to be made before work was performed. If so, a poorly designed (for secrecy) backup procedure would require the backup be made to an account that Snowden could access. There's just not enough freely available information to really know what happened, but one can come up with fantasy scenarios to paint anyone as the victim (or conversely anyone as the party at fault).
6. Re:Keylogger, not sharing by Anonymous Coward · 2014-02-13 05:54 · Score: 1
  
  It's hardly Snowden's fault that his fellow employees were too stupid to follow basic computer security procedures, like not entering their passwords on untrusted systems.
  Untrusted systems? Unless the NSA's policy is that you can only log in on your own machine, presumably other computers at the NSA count as trusted.
7. Re:Keylogger, not sharing by Anonymous Coward · 2014-02-13 06:30 · Score: 1
  
  Maybe he did, maybe he didn't.
  Snowden has already repeatedly demonstrated that virtually every NSA public communication, including those given under oath to Congress -- were completely, utterly false/fabricated/misleading/specious, bullshit.
  These generally weren't little lies/whitewashing/spinning, they were total bullshit.
  This has happened repeatedly.
  At this point, *ANY* statement from the NSA about how things happened or what happened, should be taken with the same level of confidence we would take from anything stated by a
  chronic/compulsive/habitual/pathological liar.
  And as a result, it's not that we say "the nsa is wrong".
  We do however say: "We do not believe any statement made by the NSA in the absence of direct, verifiable evidence"
  (Indirect evidence is no longer good enough with someone with their history).
  The story could be believable if it came from another party. From them... it's just not good enough unless they have cryptographically checksummed video footage stored in a distinterested third party's vault, a previous policy existing why this exists, a data retention policy indicating it should be deleted and showing why it has not been, a signed, audited paper trail showing how they obtained the records, and an audited, policy compliant configuration showing how said video was created and archived.
  In short -- there's not a chance in hell they can possibly do anything to make this statement believable at this point.
  These are problems that pathologically lying organizations have while trying to generate evidence. There's a pretty easy cure for it...
8. Re:Keylogger, not sharing by Anonymous Coward · 2014-02-13 06:45 · Score: 2, Informative
  
  You missed the first part. When the employee logged in he knew he was providing Snowden access to data he wasn't supposed to have. Nothing innocent there. What he didn't know was the Snowden was stealing his key to obtain "even greater access to classified information" [he wasn't supposed to have].
9. Re:Keylogger, not sharing by MrEricSir · 2014-02-13 07:49 · Score: 1
  
  Snowden's system was not an NSA-owned computer.
  
  --
  There's no -1 for "I don't get it."
10. Re:Keylogger, not sharing by Anonymous Coward · 2014-02-13 09:26 · Score: 0
  
  Snowden's system was not an NSA-owned computer.
  Perhaps I'm reaching for the obvious here...if that's true, then how the fuck did he even get the computer into the building?
  How the fuck did that computer connect to the local network?
  As usual, the people collecting the most sensitive information on the planet can't seem to find the time or effort to exercise basic physical security measures. I mean damn, physical security inspection and MAC filtering is Security 101 for shit like this.
  In the meantime, the perimeter is guarded 24x7x365 with a small army carrying assault rifles...not quite sure why...
11. Re:Keylogger, not sharing by Anonymous Coward · 2014-02-13 12:57 · Score: 0
  
  so, we have an unknown person making claims that his account was stolen with a keylogger.
  Not identified, but not unknown. Since been fired from his job too.
  
  Im just saying I need more proof than the guys who are using unconstitutional secret courts word for it
  Unconstitutional in who's opinion? Yours obviously, but that doesn't make it so.
12. Re:Keylogger, not sharing by MrEricSir · 2014-02-13 15:18 · Score: 1
  
  Snowden worked for the NSA indirectly. He wasn't an NSA employee.
  
  --
  There's no -1 for "I don't get it."
13. Re:Keylogger, not sharing by ganjadude · 2014-02-14 02:04 · Score: 1
  
  Not identified, but not unknown. Since been fired from his job too.
  right, because it would be so hard to make such a claim when there is no way to verify right? Let me guess there weer also pink elephants and purple unicorns who were assistants in this theft as well
  
  Unconstitutional in who's opinion? Yours obviously, but that doesn't make it so
  The constitution is pretty straight forward, especially the 4th, which is clearly being violated. It is not reasonable, or unreasonable to collect all data on all people. A warrant is supposed to be issued for a specific person/group for a specific item/group of items, that are related to a case. There is no case, therefore the warrant should never have been issued. I know reading comprehension is difficult for those in congress and the white house, but the reality is the constitution is simple to read for everyone, it was done that way for a reason
  
  --
  have you seen my sig? there are many others like it but none that are the same
No hardware access tokens? by abirdman · 2014-02-13 05:05 · Score: 1

This is the type of government organization that hires groups like RATFOR as security consultants. Who knows what they used for security procedures? Password list in /?

--
Everything I've ever learned the hard way was based on a statistically invalid sample.
angel snowden by watcher-rv4 · 2014-02-13 05:06 · Score: 1

What he accomplished, worth much more in so many levels, that social engineering, lies or even keylogger, means nothing.
After rain... by Anonymous Coward · 2014-02-13 05:13 · Score: 1

....umbrella, as we used to say.
This reminds me of some famous quote that the military is always prepared to win...past battles....
This just in! by tlambert · 2014-02-13 05:15 · Score: 4, Funny

This just in!
Officials are investigating the Washington Metropolitan Area Transit Authority, which is alleged to have aided Snowden in getting to and from secure facilities!
1. Re:This just in! by Khashishi · 2014-02-13 06:41 · Score: 1
  
  And why not? That's pretty much how it works for al Qaeda investigations, isn't it?
2. Re:This just in! by Patent+Lover · 2014-02-13 11:18 · Score: 1
  
  The METRO runs in Hawaii?
so there's down to this.... by Anonymous Coward · 2014-02-13 05:20 · Score: 1

finding low level scapegoats
Others? I'd start with Clapper by Subm · 2014-02-13 05:21 · Score: 4, Insightful

> Others Implicated in Making Snowden Data Leaks Possible
Since Snowden mentioned Clapper's lying to Congress got him to release the documents, I'd start by implicating Clapper.
From there it's hard not to implicate the Presidents who didn't honor their pledge to uphold the Constitution. Congress. Decision-makers within the NSA.
Without all of them, there would be nothing for Snowden to release.
1. Re:Others? I'd start with Clapper by X0563511 · 2014-02-13 05:47 · Score: 2
  
  I'm willing to lend a benefit of the doubt to the Presidents and such, but this does not extend to Clapper.
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Keylogger + Data Scraper by Anonymous Coward · 2014-02-13 05:34 · Score: 1

He used a Key Logger and Data Scraper, nothing complicated. Just goes to show the NSA has no clue regarding secure systems!
High school dropout not a Super Genius?? by gelfling · 2014-02-13 07:07 · Score: 0

Oh it was mostly just plain old stealing and treason. Ok thanks. We knew that.
Security and Failed Logon Attempts by Anonymous Coward · 2014-02-13 07:35 · Score: 0

For security you log and report on failed logon attempts. A common reason for a failed logon attempt is the user's password in the username field.
Treason is still treason. by hessian · 2014-02-13 07:38 · Score: -1, Flamebait

Looks like we need more rope.
If we don't punish these people, we're going to have more transsexuals and flakeout hipster potheads leaking information every time they have a relationship failure.
These people are neurotics, not heroes.

--
Futurist Traditionalism
All we know for sure... by Chelloveck · 2014-02-13 07:59 · Score: 1

All we know for sure is that there's a witch involved in here somewhere, and she will be hunted down and burned!

--
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
Ineffective security should not be a surprise... by MobSwatter · 2014-02-13 08:06 · Score: 1

The government has failed to uphold it's most basic responsibility of upholding the constitution, what makes you all think they are effective in handling computer security? It is in fact ineffective in a lot more ways than that.
Of COURSE he had accomplices by DoofusOfDeath · 2014-02-13 09:27 · Score: 2

The accomplices were the perps who violated our Constitution. Without them, Snowden would have had nothing to expose.
YANAL by s.petry · 2014-02-13 09:54 · Score: 3, Interesting

This is what is called speculation, and would be thrown out in court. Snowden claimed long ago he didn't, these people are claiming he did. I trust Snowden a bit more than I trust most of the shitheads we currently have in Government, and could easily find character witnesses who are unbiased to support Snowden.
Keep being distracted by all the hand waives though.
For what it's worth, IANAL either. I am not fooled by the distractions they keep playing against people.

--
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
1. Re:YANAL by antdude · 2014-02-14 01:16 · Score: 1
  
  Vote Snowden for mayor, government, and president! :P
  
  --
  Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
why so much snowden love? by Anonymous Coward · 2014-02-13 10:51 · Score: 0

Some say Snowden was trying to stick it to politicans. There's one problem.
The people who get screwed by leaked operational intelligence aren't the politicians.
It is Private Snuffy the 19 year old bulletlauncher fresh out of high school & basic who pays the price.
The reason we have sysops paid $200k in NSA is to make sure our neighbor's 19 year old kid
comes back in one piece -- and that kid has a salary 1/10th of what Snowden earned. Snowden
was in a position of -trust-.
People imagine a lot bullcrap when it comes to government surveillance. Lots of hypotheticals and
arguments about principles. But I assure you, dead soldiers is all too real. And thats why every
branch of government supports snooping w/ a warrant.
snowden snowden snowden by Anonymous Coward · 2014-02-13 11:32 · Score: 0

When will we see the NSA in the news for their involvement in illegal activity and overwhelmingly compromising our national security.
Admin by Anonymous Coward · 2014-02-13 11:57 · Score: 0

Here's how I think it went down.
"I need to fix something. What's your login info?"
"Username: PatriotFreedom2001 Password: GeorgeWBushlovesCheney1234"
"Thanks."
thank you for not using "theory" by Anonymous Coward · 2014-02-13 13:26 · Score: 0

oh god, thank you for using hypothesis instead of theory
Uh Oh by Anonymous Coward · 2014-02-13 15:42 · Score: 0

Major.
These two will be made the scape-groats.
Their death will be announced by Obama himself because he cannot kill Snowden: Ah the "Sochi Heist Failed!, Obama Pissed!" yet again Obama-kun misses the mark. His "Genius Plan" did not even get off the ground (NATO can be counted on for failure in the crotch!) So where does THAT leave our Obama Genius? In the gutter! Looks like Obama can't bowl and can't drive a car! And he is so "Suped Up" at time ... he can't even talk straight or use a pen to sign anything! What a ... POT Head! President POT HEAD! Ha ha!
Bad for Obama! Good for us!
In other news... by Anonymous Coward · 2014-02-13 17:28 · Score: 0

Even slashdot users with 4 digit UIDs uncritically believe government propaganda and do not know the legal definition of treason.
I knew it by Anonymous Coward · 2014-02-13 17:31 · Score: 0

Prozak supports the ZOG regime. Go away and listen to some shitty faggot metal you guinea greaseball.
3 Z.O.G. 3 by hessian · 2014-02-21 13:37 · Score: 1

You heard it here first.

--
Futurist Traditionalism