7 ms·
I think the common misconception is that a security clearance gives you access to things. The reality is that a specific role / need to know gives you access to
by t0mas88 5y ago
I think the common misconception is that a security clearance gives you access to things. The reality is that a specific role / need to know gives you access to things if you have the clearance, not the other way around.
If you clear millions of people, that sounds unsafe to the general public, but it isn't really because the clearance is only a confirmation that nothing is wrong in your background. It doesn't give you any access.
- ganoushoreilly 5y agoExactly, most programs require specific compartmented information and additional read in. I've only ever seen people with vanilla clearances working operational positions to manage facilities, etc.
- deleted 5y ago[deleted]
- starwind 5y agoLOL from reading the New York Times reporting on the DoD’s internal UAP (UFO) reports last summer me and a guy I worked with guessed which compartment it fell under. We went to our FSO and asked for access to that compartment and he was like “why do you need that?” Us: “UFOs!” Him: “Oh, you mean FUOU? That goes by CUI these days.” Us: “No, UFOs like Aliens!” Him: “GET THE HELL OUT OF MY OFFICE!” So yeah, even with TS/SCI I couldn’t couldn’t get access to aliens :|
- Jtsummers 5y agoFOUO, for official use only. That’s non-secret but not appropriate for general release information (for some reason). CUI is the updated version of that level of classification.
- iramiller 5y ago(Controlled Unclassified Information)
- austincheney 5y agoSome examples: FOUO - A doctors patient list. That isn’t the business of the public and should not be released. That data does not contain PII, patient health data, and is not protected as a matter of security but it is still protected data. Classified - Data that is restricted from public release. This is lowest level of protection and is intentionally vague. Secret - Information that if disclosed can be used to harm people or disrupt government operations by adversaries. This includes information like convoy travel schedules and communications outages. Secret data is typically really boring office information in otherwise more exciting work. Top Secret - This information, if disclosed, will likely result in embarrassment to the extent that national security or diplomatic relations suffer or that the intentional imminent danger of death or bodily harm occurs to people.
- stephenboyd 5y agoI get what you're saying but a doctor's patient list contains PII and patient health data. The fact of a patient seeing a certain doctor, especially a specialist, reveals some private health information of a patient.
- deleted 5y ago[deleted]
- dreamcompiler 5y agoConfidential is the lowest level of Classified. Classified is the overarching term for all the above except FOUO. e.g. all Secret is Classified but not all Classified is Secret.
- Pokepokalypse 5y agoyou're not wrong; conceptually. But those aren't the actual definitions. https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520001m_vol1.pdf?ver=2018-05-04-091448-843 https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/do...
- cronix 5y agoDon't feel too bad, neither can the POTUS with whatever level of access they have.
- trenchgun 5y agoYou did not have a proper need to know.
- the_snooze 5y agoIt's also a common misconception that classified information is super-special-whiz-bang-James-Bond information. A lot of it is really dense technical stuff that wouldn't be of interest to outsiders unless they were foreign agents looking to steal, say, tolerances for parts that go into a piece of military equipment.
- patentatt 5y agoAlso, if you only protected your most important secrets, it would be pretty easy for an adversary to spot where those are and who might have access to them. By having a very wide scope of what’s classified, the really juicy stuff is a needle in a mundane haystack.
- 13of40 5y agoI had a secret clearance in the Army 25 years ago, and the sexiest secret I ever learned was a number...which was the obvious product (like literally x*y) of two unclassified numbers.
- vlovich123 5y agoIf x and y were primes then your secret was probably quite valuable at that time. 25 years ago is about the right time for RSA encryption to still be state of the art at the NSA and whatnot. The reason this is valuable is that you can multiply the two numbers quickly, but figuring out the two numbers knowing only the product is extremely hard (mathematically/computationally). When x and y are large primes, then the division takes a long time (decades depending on the size of the number). Is it possible that you actually learned some important private cryptographic key? If so, that number might have been sexy but you just didn’t actually have visibility into a bigger picture?
- perl4ever 5y ago>If you clear millions of people, that sounds unsafe to the general public It sounds unsafe once all the information collected on those millions of people is placed in a central location and then hacked by or leaked to a nation-state level adversary. If you said that 99% of them don't actually have power or access, it could be true, but irrelevant if an adversary has essentially 100% and unlimited resources to review them and double check the work. >the clearance is only a confirmation that nothing is wrong in your background In theory. The security clearance investigators are not perfect, and moreover, it's been publicly reported that sometimes contractors have falsified records showing they performed investigations. Statistically, X% are going to be flawed. If an adversary has ~100% of the records, then think what they can do by reviewing them. Compromising someone doesn't require an earthshattering discovery because the cardinal sin is failure to disclose. Let's say, for example, a person smoked pot a few times. From what I've read, that's generally not a big deal as long as you aren't doing it currently and don't lie about your history. (The DOE rule seems to be that if you haven't used illegal drugs for two years, then they're not disqualifying per se, depending on a holistic look at a person) But if an adversary has the entire investigation and every other piece of information that the federal government has on every employee, and they can determine that a given person did in fact conceal anything, then it is leverage to compromise them. Do X or you will be exposed as having lied. Or even "do X or you will be framed as having lied". It could be just enough to get someone to perform some action that further compromises them, and so on. The more people this is done to, the more it snowballs. They could say "this higher up person works for us, so if you don't cooperate they will help us frame you for X". And it could be true, so how can a person verify? If they have everyone's investigation, then all of the people who do have access to important things are at risk, and anyone who is truly spotless cannot be sure who is compromised. Ancillary information like fingerprints makes it even worse, as all covert agents anywhere can in principle be detected and eliminated. This type of apocalypse being quiet, an absence of reporting on it wouldn't be evidence against. I deduce that the whole scenario likely happened starting several years ago, based on public information, summarized at: https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... I am not making a categorical statement that seeking a cleared federal position is a mistake, but consider the gravity of the decision to trust the system if you do.
- kstrauser 5y agoRight. The algorithm isn't: if has_clearance(): grant_access() but if not has_clearance(): reject_access() as the first hurdle to jump.