5 ms·

What does AOL have to do with it. Gmail has two factor, but the password reset nullifies it. https://news.ycombinator.com/item?id=8541313 https://news.ycombinat

What does AOL have to do with it. Gmail has two factor, but the password reset nullifies it. https://news.ycombinator.com/item?id=8541313 https://news.ycombinator.com/item?id=8541313 I understand commercial email accounts aren't secure. So I don't treat email as being secure. Look at what you have here. A pair of half drafted generic position papers. A legal memo about a document review protocol (I carry stuff like that in my unlocked briefcase). And a couple of what appear to be public documents about torture. The most potentially embarrassing thing on there is his SF86. But a quick scan of it doesn't show anything embarrassing on there. If he was sending actual sensitive information on an insecure email, that is a problem.

001sky 11y ago
Isn't the problem with publish sf86 more complicated...? This is basically the security clearance application for the CIA director...Aren't these things classified? Why on earth is this in any unsecure e-mail correspondence, if that is so? If that is not so, HR or homeland security has some gaps in their document handling process. Not that they haven't been hacked independently already, but still.
- rhino369 11y ago
  The government is supposed to keep the copy you gave them secret until you die. Coincidentally, the OPM accidentally leaked a bunch of them a few weeks/months ago. But it's your own information, you can do what you want with your copy.
  - 001sky 11y ago
    Most formal document policies cover drafts and works-in-process (ie, so they don't become less classified because they are incomplete or penultimate in version control.)
    - olympus 11y ago
      But the SF86 isn't actually classified. It's just Privacy Act information and FOUO. The Privacy Act says how to protect other people's information and FOUO means "For Official Use Only," but he's not breaking any laws by having his own SF86 on a public email service. He's fine as long as he isn't using it for unofficial business (which I'm not sure how) and he doesn't have other people's SF86 .
      - 001sky 11y ago
        Thanks for this clarifying comment. Open issue IMHO is if CIA's "actual process" is subject to levels of scrutiny/protection beyond the statuatory minimum(s). This being an exec appointment w/ senate confirmation etc.
- panarky 11y ago
  This is just one SF-86. China already has the entire database of all SF-86s[1]. Officials said hackers accessed not only personnel records of current and former employees but also extensive information about friends, relatives and others listed as references in applications for security clearances for some of the most sensitive jobs in government. "It is a very big deal from a national security perspective and from a counterintelligence perspective," FBI Director James B. Comey said at a meeting with reporters Thursday at the FBI headquarters. "It's a treasure trove of information about everybody who has worked for, tried to work for, or works for the United States government." [1] https://www.washingtonpost.com/news/federal-eye/wp/2015/07/09/hack-of-security-clearance-system-affected-21-5-million-people-federal-authorities-say/ https://www.washingtonpost.com/news/federal-eye/wp/2015/07/0...
  - 001sky 11y ago
    see the last sentence of my comment
    - Phlarp 11y ago
      The CIA keeps it's own personnel records, so as I understand it, this SF86 form is a new addition to the previously hacked OPM records. Not sure if CIA held SF86's are considered classified, but even if they are I suspect we won't see anyone, let alone a director, prosecuted for having a copy of their own "classified" employment questionnaires.
drdeadringer 11y ago
> What does AOL have to do with it. I cannot help but hear Tina Turner singing. "What's AOL got to do -- got to do with it? What's AOL, but a second-hand email..." That aside, it is an indicator toward technology adoption. Despite "why fix it" attitudes, a CIA or NSA director should employ more modern email methods -- PGP or other encryption types notwithstanding. Although I'm not picturing a government top dog dialing up for email, what else am I supposed to first imagine when I hear "AOL" and a related governmental acronym? "We internet chat over AIM"?

001sky 11y ago

Isn't the problem with publish sf86 more complicated...? This is basically the security clearance application for the CIA director...Aren't these things classified? Why on earth is this in any unsecure e-mail correspondence, if that is so? If that is not so, HR or homeland security has some gaps in their document handling process. Not that they haven't been hacked independently already, but still.

rhino369 11y ago
The government is supposed to keep the copy you gave them secret until you die. Coincidentally, the OPM accidentally leaked a bunch of them a few weeks/months ago. But it's your own information, you can do what you want with your copy.
- 001sky 11y ago
  Most formal document policies cover drafts and works-in-process (ie, so they don't become less classified because they are incomplete or penultimate in version control.)
  - olympus 11y ago
    But the SF86 isn't actually classified. It's just Privacy Act information and FOUO. The Privacy Act says how to protect other people's information and FOUO means "For Official Use Only," but he's not breaking any laws by having his own SF86 on a public email service. He's fine as long as he isn't using it for unofficial business (which I'm not sure how) and he doesn't have other people's SF86 .
    - 001sky 11y ago
      Thanks for this clarifying comment. Open issue IMHO is if CIA's "actual process" is subject to levels of scrutiny/protection beyond the statuatory minimum(s). This being an exec appointment w/ senate confirmation etc.
panarky 11y ago
This is just one SF-86. China already has the entire database of all SF-86s[1]. Officials said hackers accessed not only personnel records of current and former employees but also extensive information about friends, relatives and others listed as references in applications for security clearances for some of the most sensitive jobs in government. "It is a very big deal from a national security perspective and from a counterintelligence perspective," FBI Director James B. Comey said at a meeting with reporters Thursday at the FBI headquarters. "It's a treasure trove of information about everybody who has worked for, tried to work for, or works for the United States government." [1] https://www.washingtonpost.com/news/federal-eye/wp/2015/07/09/hack-of-security-clearance-system-affected-21-5-million-people-federal-authorities-say/ https://www.washingtonpost.com/news/federal-eye/wp/2015/07/0...
- 001sky 11y ago
  see the last sentence of my comment
  - Phlarp 11y ago
    The CIA keeps it's own personnel records, so as I understand it, this SF86 form is a new addition to the previously hacked OPM records. Not sure if CIA held SF86's are considered classified, but even if they are I suspect we won't see anyone, let alone a director, prosecuted for having a copy of their own "classified" employment questionnaires.

drdeadringer 11y ago

> What does AOL have to do with it. I cannot help but hear Tina Turner singing. "What's AOL got to do -- got to do with it? What's AOL, but a second-hand email..." That aside, it is an indicator toward technology adoption. Despite "why fix it" attitudes, a CIA or NSA director should employ more modern email methods -- PGP or other encryption types notwithstanding. Although I'm not picturing a government top dog dialing up for email, what else am I supposed to first imagine when I hear "AOL" and a related governmental acronym? "We internet chat over AIM"?