5 ms·

Actually, he probably didn't: https://news.ycombinator.com/item?id=6300057 https://news.ycombinator.com/item?id=6300057

• untog 13y ago
  Well, in which case, it's staggering that security was so weak that he could do that!
  • frankydp 13y ago
    The real issue is why did they have human L/P access on their PKI system. Usually unclass systems require PKI regardless of L/P. Even the DOD contracting system requires both. And if they did not have L/P then the issue is far more concerning in that PKI was compromised.
  • bradleysmith 13y ago
    It is a pretty good indicator of effectiveness of the clearance process, in my mind. I'd hate to be the person that signed off on granting Snowden's clearance. It was a total failure of the 'compartmentalization' mode of thought, probably by Snowden's own design. He had the somewhat unique authorization to take files off-facility on a thumb drive, then used other clearance-level user information to pull 'juicy to leak' intel. He was also a sysadmin, so... Quis custodiet ipsos custodes? if you're in charge of user authorities, you're probably in a pretty good position to get into stuff you shouldn't. I like the quote NBC News [1] used from their 'former intelligence official' : The damage, on a scale of 1 to 10, is a 12 lol, whoops. [1] - http://investigations.nbcnews.com/_news/2013/08/29/20234171-snowden-impersonated-nsa-officials-sources-say?src=a0b http://investigations.nbcnews.com/_news/2013/08/29/20234171-... EDIT - typo