NSA Networks Might Have Been Missing Anti-Leak Technology

This story has been updated with a statement from NSA. 

A National Security Agency information security official who left the agency in the summer of 2012, said that at that time, there was no anti-leak technology on networks to help prevent the disclosure of sensitive information. Such technology alerts managers to anomalies in how insiders are accessing protected data. 

This spring, Edward Snowden, a former NSA contractor, could have taken advantage of such a loophole. He allegedly downloaded onto a thumb drive top secret files detailing the agency's controversial surveillance of millions of Americans' call records and foreigners' online communications. Snowden, since being fired from his job as a system administrator for NSA contractor Booz Allen Hamilton, is reportedly in Moscow seeking asylum in South America while U.S. officials seek his extradition on charges of espionage. 

Defense Department officials have said a Host Based Security System, which, among other things, monitors removable data devices such as CDs and thumb drives, was activated departmentwide to track unauthorized network activities. NSA is a Defense agency. 

"When I left, HBSS was not installed at NSA," the former cybersecurity official said, adding the agency doesn’t always follow Pentagon advice.

The tool was rolled out at Defense following security breaches allegedly committed by Pfc. Bradley Manning, who sent anti-secrets website WikiLeaks a trove of digital materials revealing sensitive combat actions in the Middle East. 

In the wake of the Snowden incident, NSA Director Gen. Keith Alexander said the agency will employ a “two-man rule” to reduce the risk that system administrators will raid NSA computers. 

The former NSA official cautioned the buddy system arrangement might be too tedious for technical specialists performing fast-paced work.

Even Defense's system might not be able to halt a rogue employee in real-time because it generates a lot of false alarms that could desensitize supervisors to real trouble, the former NSA official said. But at least NSA would have been able to review audit logs of network activity, using pattern-matching technology, to spot inappropriate user actions, the official added.

There is no technological solution to prevent someone from leaving an NSA facility with removable media in hand. "Once it’s extracted there's not much you can do about that," the former official said. The best safeguard would be locking down the content at the source. "You want to make sure that you have access controls on the original data itself," the person said. "Suppose it was court-related data, there's only very few people who need to look at that data."

The former official said background checks and other human decision-making cannot avert national security leaks. "You have to make sure technical controls are in place,” the person said.

NSA spokeswoman Judith Emmel said in an email, "As Gen. Alexander has directed, NSA is working around the clock to investigate, analyze and address the issues and their root causes -- both in the immediate [future] and over the longer term.”

(Image via Andrea Danti/Shutterstock.com)