Pentagon Investigators to Probe NSA’s Crackdown on Rogue IT Employees

A Defense Department inspector general is initiating a review of a National Security Agency crackdown on computer users who have access to too much information. 

Be it a rogue contractor or an unknowing employee with sloppy login and logoff habits, insiders are a major threat to U.S. secrets, say researchers and federal officials. 

Congress has taken notice.

A classified addendum to the 2016 Intelligence Authorization Act contained an "inspector general classified reporting requirement” relating to NSA internal security protections, according to a Jan. 6 memo from Carol Gorman, assistant IG for readiness and cyber operations. 

"Specifically, we will determine whether National Security Agency processes and technical controls are effective to limit privileged access to National Security Agency systems and data and to monitor privileged user actions for unauthorized or inappropriate activity," she said in the document, which was addressed to top brass at the Pentagon.

In the wake of excessive downloading by ex-NSA systems administrator Edward Snowden, the agency has been trying to keep a closer eye on users with sweeping access to files. For example, as of 2013, there is a "two-man" policy that two people must be present when sensitive information is read or moved.  

The insider-threat inspection is scheduled to start this month. 

It is one in a series of reviews of safeguards in place to protect the NSA network and infrastructure. The whole audit will examine whether its controls have actually improved the security of the agency's "systems, data and personnel activities," Gorman said. 

She said she is open to suggestions from management on adding or revising the objectives of the assessment. 

Another federal government overseer, the Government Accountability Office, recently found the Pentagon, as a whole, needs to watch abnormal computer usage by employees more closely.

Half of a sample of military organizations assessed could not tell what average network activity looks like in their offices, according to an unclassified version of an April 2015 audit. "A baseline of normal activity" is key to curbing inside hacks, the report stated. 

During the past few years, NSA has wrapped access restrictions around each file that enters its modernized IT system so the agency can log user activity with eagle eyes, according to the agency.

NSA told Nextgov in April 2015 any piece of data ingested by agency systems since 2013 has been tagged with a digital trail, including where it came from and who is authorized to see it.  

(Image via Andrea Danti/Shutterstock.com)