8 ms·
Using an AOL email without any form of two-factor authentication should preclude you from serving as director of the CIA. How can these top government official
by nostromo 11y ago
Using an AOL email without any form of two-factor authentication should preclude you from serving as director of the CIA.
How can these top government officials be so clueless about email security when they know first-hand how effective our own intelligence agencies are at reading everyone's email?
- kodablah 11y agoThat last question might answer itself. Doesn't excuse that extra measures aren't taken of course. Granted I bet the real reason is general ineptitude towards his job as can often be found in upper management especially in governments.
- wnevets 11y agobecause the reality is these positions are more about business administration than technical prowess/common sense.
- zipwitch 11y agoNo, they're about connections with the appropriate in-group first, administrative / executive ability well below that, and technical ability or common sense will actually disqualify you.
- deleted 11y ago[deleted]
- getpost 11y agoI agree. It's like Hillary Clinton's use of a private email server shows she's too clueless to be president.
- throwawayaway 11y agoIt will be interesting to hear Hilary Clinton's take on this.
- jff 11y agoShe'll tell you it's "a distraction"
- cwyers 11y agoHillary wasn't using some AOL account, she was using a private server configured by a private security firm. ON one hand, I am betting her e-mails were much more secure than the CIA director's. On the other hand, the amount of effort and thought put into acquiring a secure alternative to a government e-mail account makes it far less likely that her motives were doing so were simple ignorance.
- Natsu 11y agoScans claim that server had ports open for RPC and VNC, so that's an open question. I know there was a VNC authentication bypass[1] some years back so we may just have to wonder given that we don't know for sure what it ran or if anyone noticed. [1] It was a really dumb bypass, too: Client: The authN methods I support are: [empty list]. Server: Ok, let's just skip authN.
- thieving_magpie 11y agoI remember reading that article about the open ports and distinctly recall they left out whether or not this was a public facing. Not that it justifies anything, but it wouldn't be egregious.
- Natsu 11y agoIt was found by someone scanning the internet at large and publishing results. Someone else went through that data long, long after the fact and looked to see if they'd ever scanned her servers. Because of that background, the public was able to see the ports--they would not have appeared in the scans if they were non-public. But that doesn't mean she actually had VNC or RPC software actually listening on those ports, or that the software that was listening (whatever it might be) was actually vulnerable. It might be more likely than not that it was vulnerable--I mean, that's why security people look for things like that to begin with--but false alarms aren't exactly uncommon, either and my customers have proven to me that there's no shortage of bizarre server configurations in the wild.
- ryan-c 11y ago
- rm_-rf_slash 11y agoAny executive position is a generalist role that ultimately depends on one's ability to play politics with the stakeholders. Clinton's emails are perhaps an example of why she should not run an intelligence agency, but POTUS is different. A president doesn't have to be an expert in everything, that's what the cabinet is for. If someone goes through considerable effort an expense to host a private email server, then perhaps the reason could be attributed to something other than cluelessness.
- pdeuchler 11y agoIn the spirit of the other commenters, never underestimate the intelligence of a career machiavellian who has risen to considerable power within the most powerful nation on earth
- Phlarp 11y agoCan't upvote this hard enough, it didn't take four whole posts for people to start calling Hillary by name in this thread.
- rgbrenner 11y agoThe issue isn't using her own private email server. The issue is whether she violated federal record keeping laws. We can only trust (since she says she turned over everything) that all emails were preserved. Some of the laws in question here carry prison time: http://www.npr.org/sections/itsallpolitics/2015/04/02/396823014/fact-check-hillary-clinton-those-emails-and-the-law http://www.npr.org/sections/itsallpolitics/2015/04/02/396823...
- Spooky23 11y agoNot really. From public accounts, State was running back level Exchange 2007 with tiny mailboxes with administration from some useless contractor. The Russians probably read the mail before the employees did. It's very common for senior execs to play all sorts of games with email. If you see folks carrying legacy Blackberry devices today, they are doing something similar.
- Aloha 11y agoThis has been my position for a long time. No one has been able to convince me that the exchange servers run by state are inherently more secure than her private exchange server was. The open ports are what one would normally expect to see open, based on what I'd read even.
- Splines 11y agoConversely, if our own intelligence agencies are adept at reading everyone's email, shouldn't they have noticed the head of the CIA using AOL and given him a heads up?
- toomuchtodo 11y agoYou don't always show your hand. Remember when the British didn't tip their hand they had cracked Enigma?
- alex_anglin 11y agoYou don't show your hand, but you typically look at it.
- fnordfnordfnord 11y agoYou want to go tell the emperor he has no clothes?
- bmsleight_ 11y agoSpot on, sometimes it can be career limiting. Never be the one to break the bad news.
- wozniacki 11y agoCould this have been some kind of booby-trapped honeypot setup strategically to lure a certain kind of hacker? Albeit, a very unquestioning & gullible one?
- sosborn 11y agoI think people confuse having the technical ability to read any email with the ability to actually read all emails.
- rhino369 11y agoWhat does AOL have to do with it. Gmail has two factor, but the password reset nullifies it. https://news.ycombinator.com/item?id=8541313 https://news.ycombinator.com/item?id=8541313 I understand commercial email accounts aren't secure. So I don't treat email as being secure. Look at what you have here. A pair of half drafted generic position papers. A legal memo about a document review protocol (I carry stuff like that in my unlocked briefcase). And a couple of what appear to be public documents about torture. The most potentially embarrassing thing on there is his SF86. But a quick scan of it doesn't show anything embarrassing on there. If he was sending actual sensitive information on an insecure email, that is a problem.
- 001sky 11y agoIsn't the problem with publish sf86 more complicated...? This is basically the security clearance application for the CIA director...Aren't these things classified? Why on earth is this in any unsecure e-mail correspondence, if that is so? If that is not so, HR or homeland security has some gaps in their document handling process. Not that they haven't been hacked independently already, but still.
- rhino369 11y agoThe government is supposed to keep the copy you gave them secret until you die. Coincidentally, the OPM accidentally leaked a bunch of them a few weeks/months ago. But it's your own information, you can do what you want with your copy.
- 001sky 11y agoMost formal document policies cover drafts and works-in-process (ie, so they don't become less classified because they are incomplete or penultimate in version control.)
- olympus 11y agoBut the SF86 isn't actually classified. It's just Privacy Act information and FOUO. The Privacy Act says how to protect other people's information and FOUO means "For Official Use Only," but he's not breaking any laws by having his own SF86 on a public email service. He's fine as long as he isn't using it for unofficial business (which I'm not sure how) and he doesn't have other people's SF86 .
- mc808 11y agoMatthew Cole had an interesting talk a while back about how Italy was able to implicate the CIA in a kidnapping and identify several agents, using cell phone tracking technology provided by the US. (Edit: Oops, Matthew Cole, not Jacob Appelbaum.)
- godgod 11y agoWhile not a talk by Applebaum, this video is semi-related and showing OPSEC failures by CIA using cell technology: https://www.youtube.com/watch?v=bM0PmwOlifE https://www.youtube.com/watch?v=bM0PmwOlifE
- dublinben 11y agoIran and Hezbollah were able to do the same thing with CIA operatives in Beirut using only commercial-grade software.[0] [0]http://gawker.com/5861484/iran-and-hezbollah-caught-all-the-cia-spies-at-pizza-hut http://gawker.com/5861484/iran-and-hezbollah-caught-all-the-...
- joesmo 11y agoWhat's the difference? If the email content was not encrypted, it'd (most likely) be available in plain text somewhere along its route. If the email content was encrypted, we wouldn't be reading it now.
- godgod 11y agoclueless...more like willfully wreckless. They know better. "It won't happen to me because I will drone strike you" is probably how they justify it. I wouldn't give two cents of the lives of these hackers right now. They are going to end up like Michael Hastings.
- alecco 11y agoDuh, plausible deniability.
- austenallred 11y agoI'm not sure. I've been going through the details in http://newsroom.grasswire.com http://newsroom.grasswire.com and I'm almost completely convinced this is all hot air. The Iran doc is public, the bill is obviously public. The policy paper is not but it’s also a draft, unclear who even authored or commented on it. They are all also from a time when Brennan didn't even work for the government. There is no indication these documents came from a compromised email address, and even less indication that any of it matters other than to say "lol the CIA Director is an idiot." I get that it's a sexy story to say "leaked emails of CIA director," but this is really not a big deal.
- ajsharp 11y agoYou can just change that "using an AOL email...should preclude you..."
- SCAQTony 11y agoUneducated, arrogant and no oversight! Roman saying: "Quis custodes ipsos custodiet." Who watches the watchmen.
- deleted 11y ago[deleted]
- kafkaesq 11y agoMy take: Kidnapping and torturing people -- and fancying that you can use bizarre linguistic constructions to either prevent the world from finding out grittiest, literally pornographic details of what you've been up to; or to reduce your own culpability in said crimes -- should preclude you from serving as director of the CIA. And secondarily, using a public-sector email service (independent of its authentication scheme, or the quality of its implementation) to conduct government business should further disqualify you, as well.