> That's nice, but obviously there was no oversight, no logging, not even simple rate monitoring. All of the above exists. In fact, it's required to exist, al

> That's nice, but obviously there was no oversight, no logging, not even simple rate monitoring. All of the above exists. In fact, it's required to exist, along with various access controls in the system depending on the protection level. All is specified in DCID 6/3.[1] That is not to say the requirements were implemented properly, or that the oversight was fully competent. It does, however, exist. [1] https://www.fas.org/irp/offdocs/DCID_6-3_20Manual.htm https://www.fas.org/irp/offdocs/DCID_6-3_20Manual.htm