3 ms·

I think the problem is not much how do you store it once it is out. I have a cheap SAN bought on Amazon that handles 20TB. The problem is how you get 20T out of

I think the problem is not much how do you store it once it is out. I have a cheap SAN bought on Amazon that handles 20TB. The problem is how you get 20T out of a place that has military-grade security. You cannot easily sneak a HD in or out - that will never pass a metal detector. You can have /some/ luck with DVDs. But if you take an average of ~5G per support (single layer DVD, to not make it fancy with a BlueRay, etc) and you get out one DVD per day, it takes 10240 days to move that data. That's a 39 years of data extraction. You can move many DVDs per day (risky), but unless you move dozens of DVDs/day, you'd still take forever.

metaphor 10y ago
> The problem is how you get 20T out of a place that has military-grade security. This remark suggests that you know the location(s) of where the data was exfiltrated from. It also suggests that you're intimately familiar with not only the exfiltration sites' OPSEC and COMSEC procedures, but of a particular government contractor's as well. Moreover, it suggests that the reported amount of exfiltrated data is unquestionably accurate. Do you see where I'm going with this? For the sake of curiousity, how would you describe military-grade security, and have you ever legitimately handled classified information in a secure enclave?
- angry_octet 10y ago
  I think there is a Hollywood perception of how classified document handling occurs, which is quite different to actual practice. The whole system runs at 'system high' mode, both computers and people, which is that everything with access is trusted, on penalty of prison time if you even make a mistake. Events are logged but not necessarily verified in real time. There are no metal detectors or routine cavity searches. The risk of leaks is treated by compartmentalisation of information. There are a few fields, like crypto, where special hardware is used to handle data (e.g. KYK fill devices), but they would be the exception. These techniques were implemented after the Walker spy ring leaked all the USN keymat to the USSR for decades. Its typical that innovation was only allowed to occur in response to a problem. Who is to say the Russians/Chinese/* have not been paying an insider for the same access that Snowden had?

metaphor 10y ago

> The problem is how you get 20T out of a place that has military-grade security. This remark suggests that you know the location(s) of where the data was exfiltrated from. It also suggests that you're intimately familiar with not only the exfiltration sites' OPSEC and COMSEC procedures, but of a particular government contractor's as well. Moreover, it suggests that the reported amount of exfiltrated data is unquestionably accurate. Do you see where I'm going with this? For the sake of curiousity, how would you describe military-grade security, and have you ever legitimately handled classified information in a secure enclave?

angry_octet 10y ago
I think there is a Hollywood perception of how classified document handling occurs, which is quite different to actual practice. The whole system runs at 'system high' mode, both computers and people, which is that everything with access is trusted, on penalty of prison time if you even make a mistake. Events are logged but not necessarily verified in real time. There are no metal detectors or routine cavity searches. The risk of leaks is treated by compartmentalisation of information. There are a few fields, like crypto, where special hardware is used to handle data (e.g. KYK fill devices), but they would be the exception. These techniques were implemented after the Walker spy ring leaked all the USN keymat to the USSR for decades. Its typical that innovation was only allowed to occur in response to a problem. Who is to say the Russians/Chinese/* have not been paying an insider for the same access that Snowden had?