WASHINGTON – Inside the top secret domain is a murky complicated world. And the latest release of classified U.S. government phone and email surveillance programs by a former National Security Agency contractor has triggered scrutiny once again on how well federal agencies guard their secrets and police their employees.
Altogether, 4.9 million government workers, including more than 1 million contractors, have confidential, secret or top secret clearance. It's not clear what level of clearance former CIA employee and NSA contractor Edward Snowden had, but the secret court ruling he released was classified top secret, and other surveillance program details he released this week were also highly classified.
Snowden's ability to provide copies of classified PowerPoint presentations to reporters suggests several security problems, including the failure to recognize he may be a threat and the failure to notice he was downloading, copying or removing data.
"Unfortunately many companies, even companies that handle confidential and privileged documents and information, do not do enough to protect that information," said Peter Toren, a former computer crimes prosecutor with the Justice Department, now a lawyer in private practice. "There's always something additional that the companies could have done."
Complicating the matter, however, is that Snowden identified himself as a computer systems administrator working as a contractor with Booz Allen Hamilton on NSA systems. If that is the case, systems administrators often have broader computer access, which allows them to find or correct problems with computer programs, networks and even access to other workers' computers.
While he may have legitimately had access to the classified information, his ability to copy and carry out the data underscores the continued gaps in the federal government's computer security.
Since the 2010 Wilikeaks release of hundreds of thousands of classified documents, spirited out by former Army intelligence analyst Bradley Manning in part on a rewritable CD labeled "Lady Gaga," the U.S. government has taken steps to crack down on computer security.
— Most drives have been disabled so workers can't download files onto flash drives or CDs.
— Access to classified networks requires a special access card, passwords and in some cases other more stringent authentication procedures
— Employees are restricted to the classified data that they need in order to do their job. As an example, a contractor working on a particular weapons system may have top secret clearance, but it applies only to that program. The worker would not have access to other programs or intelligence data. Links to other data would be disabled.
— All workers must go through computer security training. If they miss it, their computer access is automatically disabled until they finish the program.
— Defense Department computers are monitored to prevent the downloading of information onto removable drives, such as CDs or flash drives. An alarm is sent when someone tries to transfer classified data onto a removable storage device.
— There has been increased training to identify insider threats
But Snowden appears to have had access to things he should not have, according to former NSA inspector general Joel Brenner, judging by Snowden's leaking of documents so secret, they are supposed to be shared with only a few key employees on any given program.
"The man's access seems to have been extraordinary," Brenner said Tuesday. "Somebody's going to have to look at what access he had — and should have had — in all the jobs he ever held in the intelligence business. That's the investigation that's going on now. Somebody is going back and looking at every footprint or fingerprint he left in his career."
Intelligence Writer Kimberly Dozier contributed to this report.
The hottest stories ripped from the headlines, from crime to courts, legal and scandal.
