On Dec 22, 2010, at 21:21 , Barry Wellman wrote:
What person/agency came up with the idea of putting all the US State Dept and US Defense Dept diplomatic secret and confidential cables on the internal net to keep all of them in the know.
Pardon my run-on thoughts, but I wanted to offer a comment or two before signing off for the night. Regarding sharing: One of the major recommendations in the 9/11 Commission Report (and other WH-level reports over the past 15 years) was to overcome the lack of information sharing due to traditional stovepiping and historic restrictions between USG agencies that "needed" to know stuff (ie, State, Defense, the intel agencies, FBI, DHS, etc) related to national security. As such, there were major initiatives in recent years to "open up" the flow of information between USG intel orgs to make things easier for analysts to share stuff more efficiently for their jobs. Even on the public side, there now are dozens of public-private "intelligence fusion centers" that link federal, state, local, corporate, and commercial intelligence/law enforcement organisations together to share information freely. That said, the whole WL situation brings up 2 key problems (among others), in my view. Sadly, my jaded DC-based self does not see them being remedied effectively anytime soon. 1) First, there was a total breakdown of internal risk controls within the USG. Presuming it was just one "lowly private first class" involved (which I doubt, since there's never only one cockroach) how is it that any SINGLE person, trusted insider or external threat, could exfiltrate that much allegedly-sensitive-and-thusly-classified information from "the system" undetected? Speaking as a career cybersecurity/warfare person, this entire WL situation is indicative of a broad problem involving breakdowns of policy, procedure, personnel, risk controls, and technology in so many different areas that I don't want to get into at 2330 or else I won't get any sleep. (Side point: notice how the public ire from the USG regarding this situation is directed against Assange and the 'evil of Wikileaks' but not much is said on the mea-culpa aspect of "we did this to ourselves" .... which I don't expect to happen, btw. Washington loves to blame others for its own idiocy.) 2) Second, speaking from experience, there's just too damn much stuff that's classified for no legitimate reason --- but this has been a problem for the USG for decades. To wit, as one example: I read a Yahoo news article last week saying that a WL cable was "classified secret" whose contents observed that the US and Canada "enjoy a strong and healthy friendship." Oh, really? Such a secret! How many thousands of "open facts" like this are classified, and why? But secrets and clearances are the currency that makes Washington work, unfortunately....much to the chagrin of those junior folks 'downrange' who are doing the real operational military or intelligence work at the other end of the system. In all honesty, I think the fallout from the WL situation will be for the USG, in traditional kneejerk fashion, to increase its restrictions on information, enact more stovepipes and hurdles on information sharing, and so forth. In turn, this will mean folks 'downrange' who need access to stuff likely won't get it when they need it. So they find ways to circumvent these (new) controls to enable them to get that information and remain productive/continue the mission. This will introduce new vulnerabilities / potentials for problems into the system, and it's only a matter of time before the next series of leaks takes place. Lather, rinse, repeat --- it's a vicious cycle. Along those lines, I've been involved in unofficial discussions with senior-level DOD/USG folks worrying about this very thing -- specifically, will whatever is done in response to WL *really* fix the underlying problems, or simply bring us "back to the future?" /rant -- rick --- Richard F. Forno, Ph.D. (@netculture) Graduate Program Director, Cybersecurity University of Maryland Baltimore County http://www.umbc.edu/cyber