6 ms·

I'm less concerned about the hacker, and more concerned that the Director of the CIA not only has an aol.com email account but also uses that account to transmi

by rcurry 11y ago

I'm less concerned about the hacker, and more concerned that the Director of the CIA not only has an aol.com email account but also uses that account to transmit sensitive information. I'm not just saying this to be a jerk - this should be grounds for immediate termination of his employment. This is clearly a guy who shows poor judgement with respect to the management of sensitive material. Also, from the article: "[The] problem with these older-generation guys is that they don’t know anything about cybersecurity, and as you can see, it can be problematic.” On the contrary - these "older-generation guys" cut their teeth in an environment where we were going head-to-head with the KGB on a daily basis. These guys have a solid understanding and awareness of basic information security procedures, as well as a strong understanding of adversary capabilities. I don't buy it.

xlm1717 11y ago
It's plain negligence. Unfortunately, in this political climate it's not favorable to punish a high-ranking government official over mishandling their emails, even if said email is used to transmit sensitive information.
- untog 11y ago
  Why, whatever could you be referring to
  - hartator 11y ago
    I suppose he's referring to the Clinton's case.
    - scott_karana 11y ago
      He was being sarcastic, pretty sure. ;)
fweespeech 11y ago
Some part of me hopes it was part of a disinformation campaign in the form of expected-levels-of-incompetence-leads-to-"hacked"-account. However, the fact its expected levels of incompetence :/
baconner 11y ago
The key point for me is even if we assume that security blunders like this or say keeping a private email server are ignorance rather than malice ignorance is unacceptable at this level of government. Where's the security officer at advising these officials and helping them do it right? That has to be someone's job right?
- detaro 11y ago
  That someone also is replaced if he gets on the nerves of the guy he is advising to much, at least on this level. Parallel advising/control structures only work if they have someone higher up they can fall back on if necessary.
  - baconner 11y ago
    You've got me there. Ultimately being secure is Brennan's responsibility. Maybe we need a secret service for tech that's outside the command structure of these agencies.
godgod 11y ago
You want to fire Brennan? I heard the last guy that had dirt on Brennan...ended up having his car blow up. Michael Hastings ring a bell?
blowski 11y ago
Ultimately, this is the same as when the CEO tells me he's disabled anti-virus protection because the popups annoyed him, or that he's using a personal Dropbox account so he doesn't have to go through that pesky login process onto the network drive. My guess is that to many people in power, the benefits of using these web services seem to outweigh the disadvantages because they just don't understand the disadvantages. "It's OK - I set a great password!" There's simply nobody powerful enough to monitor what they're doing, independent enough to want to do something about it, and respected enough for people to listen. We need independent bodies that act as national 'IT departments' and can refuse requests from the very highest powers, in much the same way that any other Head of IT can fire someone for gross misconduct because they were downloading torrents on their company laptop.
- jegutman 11y ago
  You make a totally fair point, but I think it's also a fair criticism of the state of proper computer security that plenty of people opt-out as a result of the inconveniences. Someone will solve this someday and make a lot of money, but I have no idea what the solution is.
- wavefunction 11y ago
  The US Federal system was designed to have checks and balances provided by oversight by different branches of government. Unfortunately today we have people in these branches of government who either won't do their duty because they are terrible at their jobs or because there is a silent quid-pro-quo where these sorts of people look the other way for each other.
  - blowski 11y ago
    While you're absolutely right in your diagnosis of the problem in the US, I doubt these problems are specific to the US government. I'm a Brit, and there are enough stories of technical incompetence here to make me assume it's a global problem. I suspect even non-democracies have the same issue. Who's going to tell Kim Jong-un he needs to rotate passwords?
ZanyProgrammer 11y ago
Except email and pcs that we have in their current form today weren't around in the 60s and 70s when these older guys cut their chops
samstave 11y ago
Oh dont worry - he was probably only emailing with Hillary and as we know, she would regularly wipe her mail server with a cloth to ensure it was secure.
mcantelon 11y ago
I'm a bit suspicious of this story. Apparently his top secret security clearance application is in his AOL account, but he's been in the CIA for 25 years so that seems odd (unless his AOL account is very old).
molmalo 11y ago
I guess if this happened to some common employee, he would be fired eventually. But Director of the CIA is a political position. So, it's much harder to fire him, because of political implications.
fnordfnordfnord 11y ago
>I'm not just saying this to be a jerk - this should be grounds for immediate termination of his employment. More specifically, his security clearance should be revoked, or modified such that he's not allowed to use a computer without being supervised by a competent person; which ought to have the effect that he's basically disqualified from working for the CIA, or speaking about anything related to information security.
gideon_b 11y ago
The only sensitive information listed in this article is his application for security clearance. While that may contain a lot of personal information, that file would have been compiled and sent before he had access to classified documents, and before he had a government email address. I am guessing this kid wiggled his way into a 10+ year old AOL account containing data that was never deleted. We all probably have emails and contacts sitting in a forgotten AOL account.
- pavornyoh 11y ago
  >The only sensitive information listed in this article is his application for security clearance. While that may contain a lot of personal information, that file would have been compiled and sent before he had access to classified documents, and before he had a government email address. CNN is reporting he posted his SSN on Twitter.
ryanlol 11y ago
So far I've seen zero evidence of sensitive information being on that email account.

by rcurry 11y ago

xlm1717 11y ago

It's plain negligence. Unfortunately, in this political climate it's not favorable to punish a high-ranking government official over mishandling their emails, even if said email is used to transmit sensitive information.

untog 11y ago
Why, whatever could you be referring to
- hartator 11y ago
  I suppose he's referring to the Clinton's case.
  - scott_karana 11y ago
    He was being sarcastic, pretty sure. ;)

fweespeech 11y ago

Some part of me hopes it was part of a disinformation campaign in the form of expected-levels-of-incompetence-leads-to-"hacked"-account. However, the fact its expected levels of incompetence :/

baconner 11y ago

The key point for me is even if we assume that security blunders like this or say keeping a private email server are ignorance rather than malice ignorance is unacceptable at this level of government. Where's the security officer at advising these officials and helping them do it right? That has to be someone's job right?

detaro 11y ago
That someone also is replaced if he gets on the nerves of the guy he is advising to much, at least on this level. Parallel advising/control structures only work if they have someone higher up they can fall back on if necessary.
- baconner 11y ago
  You've got me there. Ultimately being secure is Brennan's responsibility. Maybe we need a secret service for tech that's outside the command structure of these agencies.

godgod 11y ago

You want to fire Brennan? I heard the last guy that had dirt on Brennan...ended up having his car blow up. Michael Hastings ring a bell?

blowski 11y ago

Ultimately, this is the same as when the CEO tells me he's disabled anti-virus protection because the popups annoyed him, or that he's using a personal Dropbox account so he doesn't have to go through that pesky login process onto the network drive. My guess is that to many people in power, the benefits of using these web services seem to outweigh the disadvantages because they just don't understand the disadvantages. "It's OK - I set a great password!" There's simply nobody powerful enough to monitor what they're doing, independent enough to want to do something about it, and respected enough for people to listen. We need independent bodies that act as national 'IT departments' and can refuse requests from the very highest powers, in much the same way that any other Head of IT can fire someone for gross misconduct because they were downloading torrents on their company laptop.

jegutman 11y ago
You make a totally fair point, but I think it's also a fair criticism of the state of proper computer security that plenty of people opt-out as a result of the inconveniences. Someone will solve this someday and make a lot of money, but I have no idea what the solution is.
wavefunction 11y ago
The US Federal system was designed to have checks and balances provided by oversight by different branches of government. Unfortunately today we have people in these branches of government who either won't do their duty because they are terrible at their jobs or because there is a silent quid-pro-quo where these sorts of people look the other way for each other.
- blowski 11y ago
  While you're absolutely right in your diagnosis of the problem in the US, I doubt these problems are specific to the US government. I'm a Brit, and there are enough stories of technical incompetence here to make me assume it's a global problem. I suspect even non-democracies have the same issue. Who's going to tell Kim Jong-un he needs to rotate passwords?

ZanyProgrammer 11y ago

Except email and pcs that we have in their current form today weren't around in the 60s and 70s when these older guys cut their chops

samstave 11y ago

Oh dont worry - he was probably only emailing with Hillary and as we know, she would regularly wipe her mail server with a cloth to ensure it was secure.

mcantelon 11y ago

I'm a bit suspicious of this story. Apparently his top secret security clearance application is in his AOL account, but he's been in the CIA for 25 years so that seems odd (unless his AOL account is very old).

molmalo 11y ago

I guess if this happened to some common employee, he would be fired eventually. But Director of the CIA is a political position. So, it's much harder to fire him, because of political implications.

fnordfnordfnord 11y ago

>I'm not just saying this to be a jerk - this should be grounds for immediate termination of his employment. More specifically, his security clearance should be revoked, or modified such that he's not allowed to use a computer without being supervised by a competent person; which ought to have the effect that he's basically disqualified from working for the CIA, or speaking about anything related to information security.

gideon_b 11y ago

The only sensitive information listed in this article is his application for security clearance. While that may contain a lot of personal information, that file would have been compiled and sent before he had access to classified documents, and before he had a government email address. I am guessing this kid wiggled his way into a 10+ year old AOL account containing data that was never deleted. We all probably have emails and contacts sitting in a forgotten AOL account.

pavornyoh 11y ago
>The only sensitive information listed in this article is his application for security clearance. While that may contain a lot of personal information, that file would have been compiled and sent before he had access to classified documents, and before he had a government email address. CNN is reporting he posted his SSN on Twitter.

ryanlol 11y ago

So far I've seen zero evidence of sensitive information being on that email account.