It is not really security theater if you consider all the other systems they have in place: the clearance process, auditing, etc. What I see is a use of RBAC

It is not really security theater if you consider all the other systems they have in place: the clearance process, auditing, etc. What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes. I use the SELinux sandbox to run my web browser, because it is easy to make a mistake like this: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste Ah, not so fast, the sandbox keeps that mistake from spreading all over my home directory. Now, the NSA has people who deal with important national security matters (or whatever), but they might make mistakes too. So the NSA uses RBAC to ensure that an analyst cannot accidentally copy and paste some intelligence secrets into a document that will be sent to people without clearance. Remember that the NSA does not just hire random people off the street; there is some amount of filtering meant to reduce the number of insider threats, but that process alone does not necessarily protect against honest mistakes (hence RBAC). It may also be the case that the NSA is not trying to guard against abuses by sysadmins, but by the tens of thousands of non-sysadmins they employ. In theory this is silly because it just means that your enemies will try to get their agents to work as sysadmins, but in practice it is likely to be a cost-effective solution that greatly reduces the number of people you need to worry about. Finally there is the matter of auditing. It is OK to have a sysadmin who can transition to an unauthorized security level if the audit logs record it and if you frequently inspect those logs. Again, if sysadmins are the only employees who can make such transitions, you have far fewer people you need to watch -- a net win.