Slashdot Mirror


NSA Contractor Indicted Over Mammoth Theft of Classified Data (reuters.com)

Dustin Volz, reporting for Reuters: A former National Security Agency contractor was indicted on Wednesday by a federal grand jury on charges he willfully retained national defense information, in what U.S. officials have said may have been the largest heist of classified government information in history. The indictment alleges that Harold Thomas Martin, 52, spent up to 20 years stealing highly sensitive government material from the U.S. intelligence community related to national defense, collecting a trove of secrets he hoarded at his home in Glen Burnie, Maryland. The government has not said what, if anything, Martin did with the stolen data. Martin faces 20 criminal counts, each punishable by up to 10 years in prison, the Justice Department said. "For as long as two decades, Harold Martin flagrantly abused the trust placed in him by the government," said U.S. Attorney Rod Rosenstein.

29 of 156 comments (clear)

  1. In other news by Anonymous Coward · · Score: 2, Informative

    Museum of Natural History contractor indicted over theft of classified mammoth data

  2. the NSA should put him on the payroll by turkeydance · · Score: 4, Insightful

    if he's THAT good for THAT long

    1. Re:the NSA should put him on the payroll by hey! · · Score: 5, Insightful

      This. Fuck, they should give him a nice cushy pension and his own private island for giving them the methods he used to steal said information over those 20 years.

      Unless the method he used was to exploit bureaucratic inertia and dysfunction. It's only worth paying people for information you plan to do something about. If you don't plan to do something about it, the next best choice would be to make an example of people who expose your incompetence.

      --
      Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
    2. Re:the NSA should put him on the payroll by g01d4 · · Score: 2

      exploit bureaucratic inertia and dysfunction

      I think it's more a question of trust. If you've worked on classified programs you know there's a trade-off between security practices and getting the job done in a sensible fashion. Part of obtaining a clearance depends on assessments of character. Of course mistakes will be made. Given the number of clearances and issues one might think the bureaucrats are actually doing a decent job.

  3. Double standard by Hylandr · · Score: 2, Insightful

    But Hillary did nothing wrong.

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
    1. Re:Double standard by stevez67 · · Score: 2, Interesting

      This wasn't mishandling, it was theft. Mrs. Clinton didn't "steal" her emails. Mrs. Clinton did as 2 of her predecessors in her job did with a personal email server, but I don't see anyone demanding the arrest of Secretary Powell or Rice. This guy obviously had no such role models in his immediate work environment, or they'd have been arrested as well.

    2. Re:Double standard by Fire_Wraith · · Score: 5, Informative

      IANAL, but in terms of the law as written, you're correct that intent doesn't matter. In terms of how the law has been applied, it does - and this matters to some degree, because the U.S. is part of the English legal tradition, rather than the French/Napoleonic (with the exception of Louisiana state law).
      More specifically, if you look back over the case law for this, people generally get prosecuted if:
      A) They get caught lying to the investigators
      B) Had the intent to steal, whether for profit or ideology
      To date, no one has been prosecuted without one of those two, or without prosecutors alleging one of those two. When I was in the military, I saw several cases where someone screwed up and put classified material on a system that wasn't rated for it, including email. Investigations were conducted, servers were purged, and those responsible got a slap on the wrist and a note in their file for committing a security violation (if you get enough of those, you lose your clearance). This is why Comey said what he did - cases like Clinton's result in administrative punishment at most, and the worst penalty was loss of clearance and thus job (which didn't apply anymore for her because she was no longer Secretary of State).

      In the case of this guy, likely the Prosecutors feel they have enough evidence to allege that he was trying to sell the data, probably based on his pattern of conduct, and probably also because those selfsame tools showed up for sale on the internet.

    3. Re:Double standard by misexistentialist · · Score: 2

      Did those emails really "belong" to her? It's like taking your office chair home with you

    4. Re:Double standard by dmiller1984 · · Score: 3, Informative

      That guy purposefully destroyed evidence after a 2012 interview with the FBI. I imagine that is what led to the jail sentence.

    5. Re:Double standard by Perl-Pusher · · Score: 4, Insightful

      And using bleach bit to permanently delete emails wasn't destroying evidence? Even though it was a fools errand because it existed on recipient computers is beside the point. There was a clear intent there to conceal. So yes there is a very big double standard. A Navy guy in Portsmouth VA was convicted and all he did was connect his tablet to receive emails in the field. No intent, no destroying evidence, just mishandling. I can recount an airman getting an article 15 for leaving a safe unlocked. The safe was in a secure facility designed to allow and store classified information. Basically a safe inside a vault. Career ruined over a simple lapse.

    6. Re: Double standard by Bartles · · Score: 2

      I'm, sorry but that's simply incorrect.

  4. Re:I don't buy it by MightyYar · · Score: 2

    Assume 50 TB over 50 working weeks a year and that's 1TB a week, divided over 20 years gives you an average of 5GB a week. That's well within the realm of feasibility, even if the bulk of his data collection came within the last 10 years and he was relying on thumb drives, SD cards, or the like.

    --
    W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
  5. Abused Trust by freeze128 · · Score: 4, Insightful

    Why is the trust that the government placed in the contractor worth more than the trust that the citizens of the U.S. have placed in the government? It works both ways, guys.

  6. Re:I don't buy it by smooth+wombat · · Score: 3, Insightful

    You can't see how someone, over a 20 year period, was able to gather 50TB of data? 2.5TB of material per year is insignificant to the amount of data people such as him have access to.

    --
    We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
  7. Re:I don't buy it by admin7087 · · Score: 2

    That and as someone else said somewhere else, it's the National Security Agency and not the Secure National Agency.

  8. Amazing! by Stele · · Score: 5, Funny

    Didn't have time to read the full description... but, wow!

    They've already got mammoths cloned from ancient DNA, and they're training them to steal classified data? What CAN'T the NSA do?

  9. Poor poor abused trust by thegarbz · · Score: 4, Funny

    For as long as two decades, Harold Martin flagrantly abused the trust placed in him by the government

    Sucks when it happens to you doesn't it government!

  10. He didn't steal the data, they still have it by edtice1559 · · Score: 2

    He just copied it.

    1. Re:He didn't steal the data, they still have it by Actually,+I+do+RTFA · · Score: 2

      Well, they are secrets, which are only valuable if not shared. I mean, if I publish the information to drain your bank account (usernames, passwords, etc.) you still have them. But they are now devoid of value to you.

      --
      Your ad here. Ask me how!
  11. Took? by DarthVain · · Score: 3, Interesting

    That is assuming he did it uniformly over a 20 year period, which is possible, but unlikely.

    You would think they would have not only network but physical safeguards in place to prevent this. I see this as more damning of the NSA security procedure than anything else. Regardless of how you slice it, it is a massive amount of data to be able to go "unnoticed" for 20 years!

    "Unnamed U.S. officials told the Washington Post this week that Martin allegedly took more than 75 percent of the hacking tools belonging to the NSA's tailored access operations, the agency's elite hacking unit."

    Took? They don't have it anymore? Unnamed US officials could have better used the term "copied" I think (though not totally wrong I suppose).

    Somehow I finished that sentence with, When reached for comment Martin said "the other 25% of the hacking tools were rubbish!" :p

    1. Re:Took? by Ogive17 · · Score: 3, Interesting

      You would think they would have not only network but physical safeguards in place to prevent this. I see this as more damning of the NSA security procedure than anything else. Regardless of how you slice it, it is a massive amount of data to be able to go "unnoticed" for 20 years!

      Sometimes when someone has worked in a certain area for 20 years, they are given more responsibility. Maybe this guy was suppose to be the safeguard? Not saying that is right way to handle sensitive information but I don't have the details.

      Took? They don't have it anymore? Unnamed US officials could have better used the term "copied" I think (though not totally wrong I suppose).

      Took is a completely acceptable term. He took the data with him. It doesn't say "stole" which would really cause a pedantic shit storm here on /.

      --
      "Action without philosophy is a lethal weapon; philosophy without action is worthless."
  12. My money is on ... by CaptainDork · · Score: 4, Interesting

    ... backup tapes.

    Those are so easy to walk off with.

    I'm retired IT, and many times when I was assisting on another site, I saw backup tapes and EHD, some old, laying around in plain site, some in drawers where tools and connectors were stored, so yeah.

    --
    It little behooves the best of us to comment on the rest of us.
    1. Re:My money is on ... by CaptainDork · · Score: 2

      Dropbox would be the best choice according to this anecdotal evidence provided by long-time /. reader, CaptainDork ( 3678879 ):

      I was working on a manager's (boss's son) machine because he had lost a photo for a legal matter.

      I searched for *.jpg on his hard drive and came up with lots of photos, including a Dropbox folder with iPhone pictures and videos of him and his wife doing the, you know, uh, you know ... ... fuck it we're all adults here so, I'll come right out and say they were "doing it," if you get my drift.

      So, I followed the Technology Administration Policy (authored by me) and just put both hands in the air and told his paralegal to get me someone from HR.

      When the suit got there, I told her, pointing to the computer, "This is in your wheelhouse. Let me know when you're through so I can find a lost photo."

      That manager didn't know that by installing Dropbox on his work computer (in violation of my policy), he was synchronizing all his personal shit into a local folder.

      Come to find out, there were photos and videos of him and his girlfriend, too.

      --
      It little behooves the best of us to comment on the rest of us.
  13. Please don't feed the trolls. by mmell · · Score: 2

    A/C has demonstrated a mastery of pseudoscience. If you continually insist on citing scientific facts, how can it ever succeed in its quest to transmute lead into gold?

  14. Re:Good reason... by WheezyJoe · · Score: 4, Insightful

    ... not to out-source critical shit to contractors.

    But you want to be able to hire and fire them easily, on the whims of the budget, right? And to show efficiency with as tiny a staff as possible, right? And to obfuscate responsibility if something goes wrong, right? If your assistant commits treason on your watch, you're to blame because you should have picked up on it, at least. But a contractor? Who takes the fall for contracting the contractor? Fingers point everywhere but nobody's directly responsible for what a contractor does (except when he does something good, you can take credit).

    Out-sourcing. Your stepping-stone to success in management.

    --
    Take it easy, Charlie, I've got an Angle...
  15. Re:I don't buy it by nospam007 · · Score: 4, Funny

    "They said he stole 50+ TB of data from the NSA.
    I'm not sure how this is possible?"

    Read again, he also stole a mammoth to transport the stuff.

  16. Let's review just what she told us ... by Xenographic · · Score: 2

    > More specifically, if you look back over the case law for this, people generally get prosecuted if:
    > A) They get caught lying to the investigators

    So what do you call this? Not to mention destroying items under subpoena. Here's the full hearing if you want more context.

    > This is why Comey said what he did - cases like Clinton's result in administrative punishment at most, and the worst penalty was loss of clearance and thus job (which didn't apply anymore for her because she was no longer Secretary of State).

    There's also the fact that Obama's AG, Loretta Lynch, would have had to prosecute a presidential candidate. It's not like this server was some accidental thing or that she was ignorant of the Presidential Records Act. Here's where I discuss her email with Colin Powell on how to cheat the oversight. The original email is here (click 'view original PDF'). And here's a transcription of it for anyone who hates PDFs. Some typos are in the original, but compare with the PDF if you want to be sure I didn't add any:

    C06125520 UNCLASSIFIED U.S. Department of State Case No. F-2016-11013 Doc No. C06125520 Date: 09/08/2016

    Re: Question
    From: Colin Powell [redacted] [RELEASE IN PART B6]
    To: Hillary Clinton hr15@att.blackberry.net B6
    Subject: Re: Question

    I didn't have a BlackBerry. What I did do was have a personal computer that was hooked up to a private phone line (sounds ancient.) So I could communicate with a wide range of friends directly without it going through the State Department servers. I even used it to do business with some foreign leaders and some of the senior folks in the Department on their personal email accounts. I did the same thing on the road in hotels.

    Now, the real issue had to do with PDAs, as we called them a few years ago before BlackBerry became a noun. And the issue was DS would not allow them into the secure spaces, especially up your way. When I asked why not they gave me all kinds of nonsense about how they gave out signals that could be read by spies, etc. Same reason they tried to keep mobile phones out of the suite. I had numerous meetings with them. We even opened one up for them to try to explain to me why it was more dangerous than say, a remote control for one of the many tvs in the suite. Or something embedded in my shoe heel. They never satisfied me and NSA/CIA wouldn't back off. So, we just went about our business and stopped asking. I had an ancient version of a PDA and used it. In general, the suite was so sealed that it is hard to get signals in or out wirelessly.

    However, there is a real danger. If it is public that you have a BlackBerry and it is governmend and your are using it, government or not, to do business, it may become an official record and subject to the law. Readingi about the President's BB rules this morning, it sounds like it won't be as useful as it used to be. Be very careful. I got around it all by not saaying much and not using systems that captured the data.

    You will find DS driving you crazy if you let them. They had Maddy tied up in knots. I refused to let them live in my house or build a place on my property. They found an empty garage half a block away. On weekends, I drove my beloved cars around town without them following me. I promised I would have a phone and not be gone more than an hour or two at Tysons or the hardware store. They hated it and asked me to sign a letter relieving them of responsibility if I got whacked while doing that. I gladly did. Spontaneity was

  17. Re:Good reason... by Anonymous Coward · · Score: 2, Interesting

    The contractor arrangement is occurring for several reasons. Of course, because the government allows it. But also many young professionals in the DC area are doing it intentionally in order to make more money. You can get a higher salary if you're a "contractor" to the NSA than you would being hired straight to the NSA. Ignoring things like benefits, the government just doesn't pay enough for security personnel. Hell, last time I looked the NSA was offering *up to* $104,000 for a job that required 5 years experience and a master's degree for software engineering (and probably requires a security clearance as well, which typically adds value to an individual....especially if you hire them when they already have the required clearance. In some cases the value can be up to $15,000-30,000, so employers can give you a $10,000 'bonus' simply for already being cleared and still come out ahead compared to hiring someone who isn't cleared at all).

    Compared to the private sector in the same area, salaries seem to be at least $120,000+ for the same requirements (5 years + masters). With that level of experience it's not uncommon to reach $130,000-140,000 for software engineers who have specialized in system security in the DC area.

    Now, with contracting, you have to go even higher because you're on the hook for your own benefits. So that person who would make $120k full-time in the private sector is probably somewhere up to $170k or higher. Now they contract themselves to the US government, which would have only paid them $100k to start with, but they have the $170k price tag based on the private sector, and they pocket the $20k difference (less taxes). So you do the same work (government work, which is infamous for being slow-paced and secure), have less risk compared to real contract/freelance work, and get more money.

    In DC you're almost guaranteed to have better benefits and more in-pocket cash if you're a "contractor". Most of these "contractor" types don't actually freelance or work anywhere else, they're just gaming the system because they know the NSA and other three letter agencies will play along.

  18. Re:I don't buy it by interkin3tic · · Score: 2

    Maybe 50 tb isn't that much compared to the monsoons of data the NSA is collecting from all of us with no idea what to do with it?