6 ms·
Hegseth had an unsecured internet line set up in his office to connect to Signal
- tweakimp 2y agoI can't understand how someone like that got into such a position.
- moomin 2y agoWell, to explain that properly, I’m going to need to explain the Southern Strategy and how that and subsequent efforts helped transform the party of Lincoln into the party of Pete Hegseth and Michael Brown.
- Tepix 2y agoWell, he has zero experience in administrative positions. Here's a quote by Mitch McConnell (R-Ky), who voted against his nomination: "Effective management of nearly 3 million military and civilian personnel, an annual budget of nearly $1 trillion, and alliances and partnerships around the world is a daily test with staggering consequences for the security of the American people and our global interests," the senator said. "Mr. Hegseth has failed, as yet, to demonstrate that he will pass this test. But as he assumes office, the consequences of failure are as high as they have ever been."
- le-mark 2y agoGood old “let the courts handle it” Mitch. This is his doing, a direct consequence of his lack of principle.
- zero-sharp 2y agoToo late for that
- petesergeant 2y agoEverything old is new again: https://www.theguardian.com/lifeandstyle/cartoon/2012/mar/16/1 https://www.theguardian.com/lifeandstyle/cartoon/2012/mar/16...
- Cthulhu_ 2y agoFailing checks and balances, and the wrong elected representatives given the power to put someone in that position. The current US administration was years in the making.
- bgwalter 2y ago[Deleted, political discussions are impossible.]
- Spooky23 2y agolol.
- sofixa 2y ago> Dragging the EU into the Ukraine war What are you talking about, most EU member states have been a part of it from day 1. Per capita and per GDP some of them have contributed more than the US.
- ashoeafoot 2y agoExisting in the same universe as russia gets you dragged into this war
- abm53 2y agoI’m not sure how this relates to the point raised.
- bgwalter 2y agoThe question was why Hegseth got into that position. The now deleted comment speculated, perhaps in a clumsy fashion, why polarizing, incompetent but loyal figures can be useful for a permanent bureaucracy to achieve its long term goals. The fact that the figures are polarizing helps, because everyone focuses on the person and not on what is actually happening. Note that this is speculation, because we do not have full information.
- scyzoryk_xyz 2y agoWe weren't 'dragged' into the Ukraine war. We watched an invasion, we saw refugees arrive in our society, we sent resources to help, we are watching war crimes and we now count Ukrainians amongst us. Our systems were taken by surprise and have taken time to respond. But the previous administration's policy was one of alliances and diplomacy and not intimidation or force. The EU has it's own agency and it is a perfectly good thing for us to 'take over'. And that guy is a cable show host.
- whizzter 2y agoThat's what the rest of the world wondered in November 2016 and 2024.
- TwoNineA 2y agoAs a canuk, I was anxious a little bit when orange man kept blathering about annexing Canada, but now seeing how uttery incompetent this administration is, my anxiety died down.
- exe34 2y agosadly they haven't replaced all the competent people yet, so I'm afraid they can still do a lot of damage. but thankfully they're working their way through the list.
- int_19h 2y agoUnfortunately, incompetents can still do plenty of harm with sufficient power at their hands. Russian invasion of Ukraine is a good example, and the power disparity was smaller there than between US and Canada.
- thrance 2y ago[flagged]
- crispyambulance 2y agoI can't understand how someone like that got into such a position. It was deliberate. President Stable Genius wants a loyal "yes man" in that critical position. The Fox new host was it. Competence and continuity are not important for what the administration is doing. If Hegseth gets cut-out, someone equally ridiculous will be chosen to fill that role.
- acdha 2y ago[flagged]
- nickdothutton 2y agoThe entire UK is "governed" (and I use the term loosely) via a series of WhatsApp groups. This is where we are at.
- breppp 2y agoNot the only country by the way. The issue here is classic shadow IT, the respective military/agencies are unable to supply anything as portable and usable as a mobile phone for classified communications. Governments are simply run the same way businesses are now run
- esseph 2y agoYou misunderstand. It's not because it's harder to use. It's because it's recorded that they aren't using it.
- breppp 2y agoI understood, however I do not agree. The signal chat did not have anything that someone would try to hide. People want easy things, they want to manage an air strike using their mobile phone from their bedroom. They don't want to sit in their office for that or use some hardened government issued device that is older, uglier and an extra brick to take along, with no real support of IM (my assumptions on DoD devices)
- deleted 2y ago[deleted]
- esseph 2y ago"people want" This is a fucking job with requirements. It's like being a doctor and ignoring the "do no harm" part. This is a job where people get killed, sometimes in large numbers. If a clown is at the helm, they are liability to them self and others and should be... forcibly removed.
- 2y ago
- firesteelrain 2y agoI don’t know how you can access Signal without a public Internet connection. It isn’t like Signal is setup on Azure US Government (as far as I am aware) or Amazon equivalent. Does anyone know? Signal uses HTTPS for contact discovery and account registration. Then, it switches to its own Signal protocol to provide end-to-end encryption. There would have to be some egress rule to allow Signal access from Azure. Signal is a commercial app. Even if access was allowed from Cloud or some other Defense network, it would still be considered “dirty” as the article says because it’s still going over the Public Internet to a commercial software provider. Communications are encrypted barring some MiTM attack. Not a good idea to discuss secret things on an app that isn’t approved for it but is this article reaching a bit? I think the article is pointing out the obvious. The only way to access Signal is over the public Internet with HTTPS and end to end encryption provided by Signal.
- Cthulhu_ 2y ago> is this article reaching a bit? Is it? This circumented the Pentagon's security protocols, presumably disrupting its air gap. This is a national security breach on the highest level, I'd say it's pretty serious and I don't understand why anyone is in the comment section trying to downplay or defend it.
- firesteelrain 2y agoHow did it disrupt its air gap? Thats presumably still in tact. If the article is true then he has an Internet connection in his office. He also has one on his personal cell, and probably his home. He could use Signal anywhere.
- kasey_junk 2y agoAnd did!
- Scarblac 2y agoThe secretary of defense was talking about military secrets on a device that does not have an air gap with the internet, so it was breached.
- gonzo41 2y agoI just want to say, as someone who was in the military at a point in time, if a private (lowest rank) did anything like this, they'd be burned at the stake. Actually if most officers did this the same would happen.
- misja111 2y agoWell, it's not that long ago that German officers did something similar. As far as I know nobody was punished. https://spyscape.com/article/webex-espionage-kremlin-leaks-german-defense-call-on-ukraine-in-diplomatic-drama https://spyscape.com/article/webex-espionage-kremlin-leaks-g...
- mosura 2y agoThe all time stupidest episode of this type was https://www.cfr.org/cyber-operations/compromise-mobile-app-used-ukrainian-artillery-units https://www.cfr.org/cyber-operations/compromise-mobile-app-u... “A threat actor compromised a mobile app that Ukrainian artillery units used to assist with targeting. The compromise of the app is believed to have allowed the threat actor to monitor the movements of Ukrainian units in order to facilitate military targeting by Russian-backed rebels in eastern Ukraine” More details https://www.theregister.com/2016/12/22/android_malware_tracked_ukrainian_artillery/ https://www.theregister.com/2016/12/22/android_malware_track...
- noja 2y agoWhy would he do that? Is this guy compromised?
- misja111 2y agoNever attribute to malice that which is adequately explained by stupidity. https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- exe34 2y agounless of course there's a lot of evidence that the whole administration is rotten to the core. it can be both malice and stupidity. it doesn't need to be one or the other.
- FranzFerdiNaN 2y agoIn the case of Trump and co you can definitely attribute things to malice and bring compromised.
- Loughla 2y agoThat rule doesn't apply to this administration anymore. Once is incompetence. Every single thing is a coordinated effort to gut every government service for personal gain.
- _heimdall 2y agoI'd be curious whether this is actually an outlier or the norm. My understanding is that Signal is pretty common in DC, and that private email servers aren't exclusively a Hilary Clinton special. Wouldn't others have to be similarly dodging network security protocol for their own non-secure communication tools of choice?
- acdha 2y agoIt’s a complete outlier. Prior to this administration, people took classified information rules and federal laws around records retention very seriously and while Clinton’s personal server used for non-classified material was a grey area back then the rules were strengthened to make that clearly off-limits.
- _heimdall 2y agoBut how do others in DC use Signal while in federal buildings, or is Signal use way less common than I've understood it to be? I'm not asking because what Hegseth did is excusable, the first offence likely would have led to his termination and charges if he was enlisted. It is still interesting, though, whether this actually is an outlier or just an article pointing out one case of an individual they want to single out.
- acdha 2y agoPeople don’t use Signal for official business. The federal government is required to keep records of how it operates, which Signal is not compliant with (deletion), and classified material is not allowed on unapproved systems. Most people take that seriously because it is a career-ending offense for a merit-hire which would effectively end their ability to get any job with the government or a contractor which requires a background check.
- _heimdall 2y agoThey're definitely not supposed to use signal for official business, especially anything classified. My question is whether people actually so though (not a question I expect answered by the way, from the outside we wouldn't really know).
- gred 2y agoThe Trump administration largely doesn't trust the employees and infrastructure which it oversees. Not only did career government employees sabotage administration priorities throughout Trump's first four years, some of the government devices provided to the administration were used against it during the "Russia collusion" investigations [1]. Based on this experience, the administration rejected the government devices offered by the GSA the second time around [2]. Because of this deep distrust, we also have the "anti-FBI guy" in charge of the FBI, the "anti-IC" gal in charge of the intelligence community, the "anti-FDA" guy in charge of the HHS and FDA, etc. I wish it weren't this way, but sow the wind and reap the whirlwind, I guess. [1] https://www.hsgac.senate.gov/wp-content/uploads/imo/media/doc/GSA%20Transition%20Records%20Investigation%20Majority%20Report-2020-10-23.pdf https://www.hsgac.senate.gov/wp-content/uploads/imo/media/do... [2] https://www.cbsnews.com/news/trump-team-transition-agreements/ https://www.cbsnews.com/news/trump-team-transition-agreement...
- d3nj4l 2y ago“Here’s why it’s YOUR fault I’m breaking the law!”
- acdha 2y agoFollowing the law is not sabotage, it’s obeying the oath they swore.
- victorbjorklund 2y agoSo change the law instead of break it.
- Applejinx 2y agoI think that's a very understandable response seeing as they colluded with Russia, serve their aims, and have every reason to worry that their continued efforts to serve Russia and undermine America will cause American government employees to be upset with them. It would be mighty silly of them NOT to take precautions against their efforts being undermined. Of course this effort of theirs will face attempts to undermine it: it's entirely hostile effort on every level, obviously in service of a hostile foreign power. Why would they trust they won't be resisted? Not everybody is foolish.
- tlb 2y agoSignal (or something like it) probably should supported by the DOD for high-level communication among defense & administration people. Under the traditional rules, certain topics can only be discussed in SCIFs, which are a huge pain in the butt to arrange a meeting in, especially as politicians travel a lot. So military topics end up disconnected from politics. (Maybe the military likes being disconnected from politics, but that's not the setup that political philosophers recommend to preserve democracy.) If the DOD managed dedicated phones with no apps except Signal, that might be better than whatever they do between SCIFs.
- freen 2y agoHmmmm… SCIF is not just a “way to encrypt the content of the conversation”. It is much much much more than that.
- plorg 2y agoI think the biggest issue with using Signal in these cases is not the risk of leaks from a compromised network (although obviously sloppy opsec has already led to unauthorized parties being added to these conversations), it's that it bypasses the kind of retention policies that are required for the purpose of holding public servants accountable. And I think that's probably on purpose.
- betaby 2y ago> retention policies that are required for the purpose of holding public servants accountable I suppose that ship has sailed. The powerful just discuss at golf clubs and such, no public records. There are public records of the things the powerful decided should be public.
- aaomidi 2y agoSignal without out of band verification is quite literally useless. Maybe if the DoD forked signal, added a way for signal to piggyback off of an existing trust system, then sure. But I would bet a lot of money that the folks in this signal chat never did the out of band verification. If you do not do the verification, you’re not in fact e2ee.
- v3ss0n 2y agoWhat's the point? Signals is designed to be secure even when connected over unsecure internet and resistant to MITM because end to end encryption.
- acdha 2y agoThe point is that he intentionally broke policy to set up a communications system which doesn’t meet federal security standards for sensitive information and also doesn’t comply with the rules for retaining records. Think of it like hiring a new bank manager who decides that they need to start storing the money in a second location with a combo lock only they have the password to. They say they’re not doing it to commit fraud but it’s unambiguously more vulnerable and, far more importantly, there’s absolutely no reason to do that except if you’re planning to do something illegal because the existing system works fine for everything they officially need to do.
- firesteelrain 2y agoWhat policy? Can you point us to it?
- Swoerd123 2y agoRepublicans have got to be some of the dumbest motherfuckers roaming this planet. Trump is the Milli Vanilli of negotiations. "Russia not taking over Ukraine is a concession". He really said it. What a stupid fucking retard.
- khaki54 2y agoIt's not like he called Comcast and had them run a line on the weekend and they snuck it in there with no one noticing. He told Comms what he needed and they gave security a business justification to set it up in a way that had an acceptable amount of risk. It's all documented and approved. And no we don't call these a "dirty" line that's something someone made up for the purposes of the article. We call it "unattrib" and it's quite common, serving many useful legitimate purposes. One thing that I find surprising about the Hegseth case is that most SecDef do not use the computer in their office it all. A couple recent ones still don't even have a computer in there. Normally staff handle 100% of communication and briefing outside of phone calls and video calls. He's clearly still adjusting to the reality of operating within the _confines_ of DoD headquarters. Also the article's mention of using Wi-fi in the back of his office doesn't make sense to me, there isn't any Wi-fi available in the suite or anywhere nearby.
- deleted 2y ago[deleted]
- woodpanel 2y ago> unsecured internet line Is this a euphemism for „VPN“ or is AP going to elaborate what they mean by this „industry standard“
- lcnPylGDnU4H9OF 2y ago> it connects directly to the public internet where the user’s information and the websites accessed do not have the same security filters or protocols that the Pentagon’s secured connections maintain (I’m not able to find the phrase “industry standard”. Where does the article use that?)
- deleted 2y ago[deleted]
- josefritzishere 2y agoI am reminded of the George Carlin quote "Think of how stupid the average person is, and realize half of them are stupider than that."
- BrandoElFollito 2y ago> [Signal]’s encrypted, but can be hacked. Kudos to the Pentagone to have technologies that cannot be hacked. As a security professional I hate these programs that put my job in danger. Thankfully this is just the journalist's and their contact at the Pentagone's imagination.
- 7e 2y agoWho knows what kind of intelligence Russia has exfiltrated over that Internet line and that desktop.
- KevinMS 2y agoIt was revealed not too long ago that its common for the CIA to use signal. They probably spend all day every day trying to crack it, so if they feel comfortable with its encryption, I'm sure the def department does too.
- geenkeuse 2y ago[dead]
- DonHopkins 2y ago[flagged]