Slashdot Mirror
New NSA Leak Exposes Red Disk, the Army's Failed Intelligence System (zdnet.com)
Zack Whittaker, reporting for ZDNet: The contents of a highly sensitive hard drive belonging to a division of the National Security Agency have been left online. The virtual disk image contains over 100 gigabytes of data from an Army intelligence project, codenamed "Red Disk." The disk image belongs to the US Army's Intelligence and Security Command, known as INSCOM, a division of both the Army and the NSA. The disk image was left on an unlisted but public Amazon Web Services storage server, without a password, open for anyone to download. Unprotected storage buckets have become a recurring theme in recent data leaks and exposures. In the past year alone, Accenture, Verizon, and Viacom, and several government departments, were all dinged by unsecured data.
Whatever happened to the DoD Orange Book levels? I would have thought that they'd have mandatory protection on all their data.
A.
Link where?
The people managing this data are the same ones many politicians think should be given a master key to all of our sensitive personal information, right?
#DeleteChrome
...
New NSA Leak ...
It little behooves the best of us to comment on the rest of us.
Seriously... In this day and age, do you really think that this is an accident? Unless more info is know, I'm inclined to believe that this is fully intentional, and any idiot that attempts to run this software is going to get what he deserves.
It's a trap!
Keep hiring consultants that take no ownership and inexpensive college guys then keep wondering why bad things happen.
More likely it was a bunch of contractors involved in a particular project that was unsuccessful and abandoned, leaving it "unmanaged". With the project over, and no people around that was involved anymore, probably no one even knew it it was out there. This is a common problem for large organizations that try to minimize the amount of IT staff on-hand, and outsource everything externally (not the leak necessarily, but the apparent lack of institutional awareness/knowledge). However on the books it looks like the employee footprint is smaller, which I guess is the point.
... if he'd just put his info up anonymously this way. But instead he wanted to make sure there was journalistic curation by mejoro media orgs to limit info to stuff that proved his point about legal violations by NSA and other govt branches.
Have to think he's bitter now.
http://www.jklossner.com/humannature/
John Klossner hit this on the head back in 2006.
Learning HOW to think is more important than learning WHAT to think.
Why don't we ever see leaks from other countries?
Because they kill their leakers?
His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain
Think like the US gov, contractors and mil.
Its the 1950-70's. Vast amounts of data is been collected in real time globally. Total encryption would slow down translation and searching.
What to do with all that data been kept on a secure base? Keep it in plain text so everyone with the correct clearance could read, search the globally collected material. From any other base or agency in the USA. While the UK was still sorting paper work and index cards the USA had real time, networked digital searching on powerful new computers.
A lack of translators and skilled people to work on so much collected data became an issue.
All any one person wanting to spy could do was walk out with paper, photographs, printed documents over time. Photocopy an entire aircraft design for another nation for cash page by page? Photocopy the US Vietnam war reports page by page?
That secure network per site security worked well but it was not a really great system for the CIA. The CIA needed the databases on US mil/gov/workers/staff/private sector who could help with support complex long term missions for freedom that could never be mentioned to Congress or anyone.
Unencrypted plain text access with no logs, no questions over all the networked US databases.
To find a person who could fly to anywhere in the world, at night and resupply some CIA funded group in another nation doing lots for "freedom".
So why not use contractors to keep the data? Bring in the private sector? No risk of an Iran–Contra affair computer discovery on always backed up gov networks https://en.wikipedia.org/wiki/...
That allowed the private sector in and once very secure data sets to spread all over the USA on huge private networks. Why let the US gov work on their computer network when the politically connected private sector could do the same work for billions in funding? No more logs, questions about projects, missions.
The results long term are what is been seen now.
US gov networks kept the plain text past because it was easy to sort and collect.
The private sector got given all that data that anyone can read, sort, understand to translate, index, add to other data from the private sector.
Nobody really wants to think about security. That blocks different parts of the US gov, mil from access and paying the private sector for that project. Per project security slows down complex searching by the rest of the US gov/mil/other contractors.
So data floats around unencrypted, on internet facing contractor networks with not much logging and not much security.
Why no security? The private sector could install some really good systems to lock that data down, secure networks, track and block most malware intrusion attempts?
Nobody wants to lock out other agency requests for the same data sets. Looking for that dream team of US mil and contractors to support freedom in another nation? Complex security might log the funding, names of the pilots, the front company aircraft used, contractors needed to load the aircraft in other nations, find the way very advanced weapons systems got supplied to the "rebels"...
What if Congress requests a copy of that log of another Iran–Contra to support freedom using different nations?
Better just to have the data sets with no security, no logs, no questions, nothing anyone in Congress can demand a decade later.
The US clandestine services cannot trust any oversight by the US political system. So no data is logged, nothing kept, no complex logs on backup. Plain text exists as is for years and is searchable.
Security is just a bad word for political oversight and questions later about missions that never officially existed and had no funding.
Thats how the US gov.mil systems got to how they are now. Once the best in the 1960's for searching and data collection is now just a way of hiding missions from political oversight.
Its worth more
Domestic spying is now "Benign Information Gathering"
They know what the MI6, NSA, CIA, GCHQ can do to computer networks that have to get imported.
They don't use network computer in the same way for mil projects.
A super computer can do calculations for mil systems.
Dont put your entire mil system on an internet facing network for the NSA, CIA, GCHQ to read from in real time.
Other nations have finally understood what the NSA and GCHQ did to their security in the 1950-1990's.
Other nations spend millions on human spies entering the USA, UK over generations. Two generations later they have the cleared, totally trusted US/UK staff to enter the US and UK security services.
The US and UK spend billions spying on digital network spying globally. Other nations know just not to have mil connected networks to spy on.
Other nations are very careful who they hire to join their spy agencies/mil too. They hire only people they can trust politically and have some understating of who will stay loyal to their nation. Staff get tested so they do not walk out secrets for cash/pleasure at the first offer by CIA/MI6.
Less of that risky contractor problem with spending problems, gambling, addictions, in need of a new friend.
The US and UK virtue signal that their spy agencies are open to all applications and will totally trust and welcome anyone. Security considerations are now a distant second to been seen attracting all kinds of new staff.
Very different ways of finding staff, keeping computers secure.
The other issue was importing US and UK mil equipment and trusting it to work.
Early 1980's Argentina found out too late that most of their new US/UK/NATO quality secure communications equipment was open to the GCHQ in real time.
The only system that slowed the GCHQ down was a South African designed communications system. Why? It had been used in a real war by South Africa and had to actually work to keep South African troops safe from other nations very advance mil collection in Africa.
Lesson most smart nations took away from that was to spread their human spies out globally and that Western export grade mil equipment is clandestine service back door junk.
Other nations have had decades of been spied on totally to finally understand how digital collection works and just don't use networks open to spying.
France lost all its embassy communications to the NSA and GCHQ during the 1950's. Was it human spies? Embassy not doing crypto to a good standard? Someone trusted back in the gov in France? Why was France not able to secure some big trade deal? Finally investigations found nothing was wrong with the human side of the gov, workers, staff. It was just the way the communications network was set up and not shielded that leaked plain text in real time.
Another lesson learned that its not always staff, sometimes its the crypto and networks that is junk.
Domestic spying is now "Benign Information Gathering"
I vaguely remember seeing references and a diagram of Red Disk. As a data point, in general the communities will keep extending projects outwards along the same naming dimension, so expect programs named "gold disk," "blue disk," etc.
Projects actually never fail in the way you'd think. Everyone learns a whole lot, then moves on to the next iteration.
Red Disk itself was one of the first attempts at what's now called a data lake, I think. You can probably dig it out of google if you cared. There were one or two followup projects, all going in different directions.
Next thing you know someone will leak more photos of the sound stage where they filmed the moon landing.
If the Visigoths (whoever they might be) invaded the US and brought it down, who would be the new Big Guy On The Block? You'd rather live with them dominating you?
Consider the possibility that this is information/disinformation they WANT to be out, without the responsibility of actually releasing it. Just a thought.