Brad worked for me at Zoto for about 6 months back in 2006 or so. I found him fiercely intellectual.
He moved to Oklahoma from England where he said he had been living with his mom. Because the driving age is 17 there, he hadn't gotten his license yet. I took to picking him up from the house and then letting him drive my car to the office so he could log time for his driver's permit.
One day he accidentally ran a stop sign, directly in the path of another car. I ended up shouting something like "Stop Brad!" at him, and reaching over and touching him on the arm as we squealed to a stop. What resulted was something I never had observed in a person before. He literally shut completely down, and for a about 5 minutes just sat there with his eyes closed, breathing. I tried getting his attention, but he was completely catatonic. I pulled the parking brake, and put the car in park because I had no idea what was going on with him.
I ended up asking him to leave Zoto a few months later, because of this and other bizarre incidences, which I chalked mostly up to being a young kid coming from a split marriage. I'm still not exactly sure what caused his strange behaviors, but it makes me sad to see that he went and straightened his life out, only to have all this happen to him.
If they don't consider history as a minor, they should refuse to grant clearances to anyone under 25 or 28.
I also seem to recall being granted S, TS, TS/SCI, etc. is a lot easier/faster if you're in the military than if you're a contractor. Different queue, different investigators, and higher presumed loyalty to the US. (i.e. you were willing to roll the dice and potentially be stuck as a cook for 4-8 years, which a spy might not be willing to do)
Yeah, I know a few folks who got their TS investigations opened and shut in about 2 months. It takes longer the older you are anyway especially if you've moved around a lot or have foreign relatives. I've seen it take as long as 3 years.
I think minors aren't really investigated because they simply don't have much of a paper trail to look into. Their security profile matches their parent's more than their own. But who knows.
Everyone in the 2600 group on Facebook got a message from Adrian last week:
Please take a moment to delete your ~/.purple/otr.private_key & re-key
as soon as possible. Verify fingerprints in an out-of-band fashion,
such as telephone.
If practical, change PGP keys, and consider re-keying on a set schedule.
Set the re-key time on your SSH sessions to 30 minutes or less. *wild guess*
There is no specific reason for this. I'm just suggesting this as a
friendly piece of advice. Please act as soon as you have the time.
Post on the wall if you have any questions about how to do the above,
or whether it applies to you. If you don't currently use OTR and PGP,
look into them, especially OTR.
If anyone here with some actual expertise in cryptography has advice,
I'm welcoming it.
*** Disable logging for OTR conversations. ***
Have a nice day.
It was strange (concerning?) enough to get that at all; now it has me wondering what else we're in for in the next few weeks.
> “[I] listened and lip-synced to Lady Gaga’s ‘Telephone’ while exfiltrating possibly the largest data spillage in American history,” he added later. ”Weak servers, weak logging, weak physical security, weak counter-intelligence, inattentive signal analysis… a perfect storm.”
The voyeuristic, excited element of it is what got him caught. I have to think that if he'd been more solemn and reserved, saying he had to balance his duty to the American people with the oaths he took, then he'd come across a lot better.
But he didn't. He didn't carefully, agonizingly release a video he thought relevant, he was talking about dumping all sorts of classified material - just to do it. Doing that haphazardly shows supply chains, movements, fortifications, investigations, counter-intelligence, logistics... it would be a gold mine for terrorists and insurgents not to just attack the armed forces, but also, maybe even more likely, to kidnap, torture, and kill civilians who are doing logistics, shipping, etc without a heavily armed escort.
My view here will be unpopular I think, and I don't say this lightly, but I think this is a rare case of where charges of treason should be brought and the death penalty sought. He was putting tens of thousands of people's lives at risk and not just soldiers... and he seemed giddy and excited about it like a 15 year old figuring out the teacher's password and changing grades.
I doubt they'll charge with him treason since it'd attract a lot of press they don't want, but his actions were incredibly reckless and despicable. For someone who has taken the military oaths to break them in such a care-free, unthinking way, lip-syncing Lady Gaga and being all jazzed up about it... it's crazy. He didn't even leak to a professional reporter who would use some discretion in what to release, he went to an anonymous website that'd publish anything.
Again, I think my view will be unpopular, but I think he should face the firing squad for it. It remains to be seen whether he'll be painted as a sympathetic person by people who don't like the war or dislike American policy in general, but a lot of people stood to die violently as a result of this man's actions if he wasn't caught.
I scanned the headline and thought "Bet all my fellow HN'ers will defend this guy, no matter what the situation, because of the old bits got to be free bullshit" (Which I agree with in principle, but I find most folks are not interested that much in the edge cases as much as the slogan)
Then I read your comment and changed my mind. Surely what he did wasn't worth the death penalty.
Then I read the article.
I agree with you, lionhearted. And the reason I agree with you is that there is only a one-in-a-million chance that any particular potentially treasonous crime would actually be treason. But this is that one-in-a-million. If this isn't treason, I don't know what would be. If he is guilty of the things he is charged with, the deterrence factor alone is worth the death penalty.
I would welcome somebody making the case that I am wrong. But I am left with the knowledge that some things -- maybe not these things but some things -- need to be secret, even in democracy. If the people charged with keeping those secrets are playing ego-based games with disclosing them, then they have to face the consequences of their actions. If everybody in service to their country, including the president, is responsible for defending the constitution, and nobody is above the law, then this guy is in serious trouble.
(And it's worse still for him because unlike leaks in the Cold War, there is no enemy power to do a spy trade in a few years. He is well and truly screwed)
If he had just leaked the footage from the helicopter, and leaked it to congress or reputable news media, and done it non-anonymously, I could buy that he thought he was a whistleblower. I still think some level of punishment would be appropriate (clearly being discharged from the military and clearance permanently barred, and probably a less than honorable discharge, and probation at least). I still wouldn't have done it (if I saw something while working that I thought was a problem, I'd bring it up through chain of command -- there are plenty of legal ways within the military to challenge something, if you're willing to put in the effort).
Wholesale leaking of TS/SCI data, defined as being able to cause "exceptionally grave damage to national security", pretty clearly meets the definition of treason. I don't think a firing squad (actually, lethal injection) would be the best punishment, but life in prison certainly would be an option.
I can't wait for the AFN commercials about this incident!
I think you have some good points but I disagree with what you think this man deserves (disclaimer : I'm an opponent to death penalty and it's even illegal in my country), his actions will have very serious consequences, and he acted stupidly, but I don't think he did this in an evil way, it's very human once you have some power to misuse it, and I think a lot (well I mean a few percent) will have done the same thing, so I'm not even sure it's a deviant behaviour, it's not like he had directly murdered anyone, maybe some will die because of him, but to me he doesn't deserve the same punishment as a murderer.
I think he's not the only one to blame, he shouldn't have access to all this sensitive data in the first place.
And maybe at the end, all this leaked informations will have a positive feedback on the USA, like in christianity, confess your faults and you'll feel better.
But I doubt it.
The FSO of the SCIF where he (presumably) worked should be investigated. His CO and the rest of his chain of command should be investigated as well. The (contract investigator, most likely) who was involved in granting him his clearance, too. I'm pretty sure that all happens automatically when something like this happens -- at the very least, they need to work on making sure this doesn't happen again, but it's hard to believe they were 100% blameless in this.
The actual IT systems used by the military for secret-or-higher classified data are kind of pathetic, actually. Certain things are done well (the "air gap" model for networks, and generally the military is decent at key management, and most members granted security clearance are good about changing passwords and reporting security probes, vs. commercial environments. However, the technology itself is often windows (2k, xp, vista), and isn't exactly the best managed network in the world. To some extent being "air gapped" causes them to be lazy about other forms of security. A lot of this has to do with the exceptionally slow procurement and integration cycle of the military, but at the core, windows is just not a great solution for building an office automation system with 100% accountability for every file.
(I'm actually working on a startup that will address this market; it's a good market, but I've also been someone at personal safety risk from security violations, so it is more compelling to me than writing another fb game or ipad app.)
I certainly don't disagree with you that the spec hasn't changed (24x7 armed guards, several levels of physical access control, razor wire, etc. etc.).
The de-facto reality is that it's much easier to walk in an out of a SCIF in theater with all manner of stuff (portable media, entire systems, etc.) than it is back here. And if you are where I think you are, you know that most of the SCIF space over there are just converted palaces and bungalows (or tents) with boarded up windows or tents with a jury rigged razor wire setup on top of the concrete blast barriers or the back of a Trojan Spirit Hummer parked outside of your hooch. Some places are tighter than others. But I was in plenty of places in Baghdad where I didn't even have to dig my badge out of my pocket to get on their systems.
Don't even get me started on the OPSEC surrounding access to SIPR systems. "Yes, let's bring a wireless router back from the Hajji Mart and hook it into our SIPR drop so we can bring our BALs out next to the fake pond and smoke cigars while we put together targeting packages. That's a brilliant idea!" or my personal favorite, the terrabyte shared drive full of porn that made it's way around the FOBs so everybody could make a copy onto their WSSs. Yes, that's a great use of the RAID'd SCSI disk array in that big green box.
I'd bet far worse exfiltration has happened just with the DCGS-A techs replacing broken equipment and moving hard drives in and out of the SCIFs under the watchful eye of the 20 year old contract security guys too busy playing pocket tanks to bother with the paperwork.
The "guards" are your buddies you eat with in the DFAC. If you have the proper ID you could bring a Caddillac full of blow up hooker dolls in and out of the spaces without anybody batting an eye.
It's just "different" there because of the nature of the environment. CONUS, if it takes six weeks for somebody to fill out the forms so I can get a disk burned with a single email off of my JWICS account (that contains no classified information at all)...that's fine. In theater, you just bring in the disk and burn it off, or just stick it on a thumb drive, if the 6 is awake you might toss a notice their way that you are bringing something out -- but they'll most likely be doing something else. Most of the time you don't bother. Every once in a while you bring out a whole big pile of stuff and toss it in a vehicle and bring it out by the lakes or the river and burn it all while drinking near beer.
I'll admit, in places where we're really well established, like Germany or Korea, the situation is just like in CONUS. But it really is just different there. Every so often somebody will come down on a unit hard for lax security, but once they've left the FOB, the unit reverts back to watching movies off the shared drive and playing pocket tanks pretty quickly. There's just other, external pressures that people have to think about more there that people in established duty stations don't have to worry about, like a mortar coming into your hooch.
Yeah, I've definitely seem some seriously lax sites, but it's vastly better than in 2004. The great anti-usb-flash jihad of 2008-2009 seems to have helped a lot, at least on nipr and sipr.
The mitigating factor is that someone in a deployed environment is probably more aware of the potential harm from letting slip (even unintentionally) sensitive or classified information. i.e. mortar in the hooch.
> The mitigating factor is that someone in a deployed environment is probably more aware of the potential harm from letting slip (even unintentionally) sensitive or classified information. i.e. mortar in the hooch.
That does seem to be the thinking/hope. But I guess as this example shows, it's not foolproof. Also, it's hard to keep people motivated about security protocols when their on their on their nth, multiple deployment.
I think that this problem applies to this case because it's obvious that the other people at the site were not watching the house very well either.
(btw, keep your head down and good luck, I was there in 2006-2007 and learned more during my deployment there than in the entire rest of my career).
It's definitely a great learning environment -- I've been doing this about 50% from 2004 to now (I'm pretty sure this is my last trip, unless I get deployed contracts for my product, which is always possible). It's almost tempting to write a book, although for it to be interesting, it would either have to be fiction set in this environment with lots of factual details (e.g. Tom Clancy), or at least fairly fast and loose with the facts. A lot of interesting stuff wouldn't be appropriate to publish, and a lot of the hyper-accurate stuff would be boring.
Wait a minutes....rdl......just checked your profile....now I know who you are! I haven't seen much about you since '05ish, since Wired did the profile on you. I actually asked around for your outfit for a while when I was over there to see about getting sat service around BIAP in '06-'07 for a couple buildings I was in. Crazy, this Internet -- small world and all that.
> A lot of interesting stuff wouldn't be appropriate to publish, and a lot of the hyper-accurate stuff would be boring.
What's the old saying? "War is long periods of interminable boredom followed by intense moments of stark terror."
There is something really bizarre about being there that's really hard for people to understand via description or pictures or stories or articles -- taking rocket fire while standing outside a Taco Bell so you can pay $3 for a taco, not even flinching because you know it's just one of 30 or 40 attacks that day and the QRF will be in the air to handle the situation anyways, and you've waited like 3 hours in line for this taco. Then you go back and watch CNN or something and hear about the attack you were just in -- and think it's getting boring, why don't they report something else? At least that's how it was back then. It's always stuck with me you could buy a brand new 46" LCD TV and a Wii to put at the foot of your bunk and a case of frozen steaks and sunflower seeds, in an active war zone. I remember thinking, "the news is describing where I am, but I can't seem to really relate it to what I'm seeing".
I've heard it's calmed down tremendously in the last couple of years. Nowhere near "safe", but not like at the end of '06 and the beginning of '07 by any stretch.
> I'm pretty sure this is my last trip, unless I get deployed contracts for my product, which is always possible
Good luck with it. Our role there is changing very fast, wouldn't be surprised to see very few contractors/civilians over there in the next 12-18 months.
I think 2011 is going to be the end (thankfully), and really summer/fall 2010 should be around the end. Iraq especially, but even Afghanistan -- I wouldn't be surprised to see mainly-SF in Afghanistan, with some presence at BAF and KAF, and maybe 30-50k total troops footprint, by 2012.
Thank you for the sincere comment and I respect your position - a lot of the usage of the death penalty is really morally questionable in my eyes, things like executing people who are barely mentally competent and making a big dog and pony show out of it. That sort of thing doesn't seem like it'd reduce crime or give any real feeling of closure to a victim, or really accomplish much at all. So I respect your position.
If you think the death penalty is wrong, full stop, then I guess it's just agree to disagree because I think there are times when it's appropriate - though, like I said, I respect your position. But if you'll ask the question of, "If there's a death penalty available for prosecutors, when should they seek it?" I'm not convinced that the answer to that is just when the person does obviously horrifying things.
Put like this - I have an expression that goes, "Satan urinates on toilet seats." I don't actually believe in Satan, mind you, what I mean is - I think evil originates less from bad motives like you see in the movies and more from people being careless, reckless, and leaving a mess. Most people are careful in a clean public bathroom, but once it gets a little messy, it gets really messy really fast. So I always imagined that, if there's a Satan, he goes around being the first one to pee on a clean toilet seat. Then all the decent people who would normally not make a mess both have to stay further away from the now-dirty bathroom, and care less if they make more of a mess.
So by punishing this man for very casually, unthinkingly sharing very important information and risking lives, I think he's absolutely culpable. If there's any place where the death penalty could dissuade people, or get them thinking more, it's here.
So a someone in military intelligence who thinks about leaking classified material has to ask themselves, "Is this important that I'm willing to die to leak it?" And thus, I don't think it'd suppress people who come across something really, really bad. But this guy was talking about dumping classified material wantonly on an anonymous server. People were going to die as a result of his actions. I wouldn't be for seeking the death penalty based on just the video of the helicopter incident, but all sorts of material just for the hell of it?
And on top of that, he took specific oaths to protect his country and his fellow soldier. He wasn't conscripted. He wasn't a random kid playing around on the internet. He volunteered to join the armed forces, and then he was trained and instructed before he become an intelligence analyst. He would've had a choice if he wanted go into that role in the armed forces, and he would've been instructed repeatedly that sharing classified information could kill his fellow servicemen and women.
I agree with you that there could be some much-needed security improvements as a result of his actions, but it's not like some kid was hacking around on servers from the internet, this is a man who carefully planned to bring materials into an area sealed off from the internet and sneak the information out. He's smart enough to steal classified information, but he's either reckless or ambivalent to the fact that people are very likely to die as a result of his actions.
If you seek the death penalty for this, you send a clear message that risking a fellow serivemen's and innocent civillians' lives haphazardly for a thrill is considered the highest of crimes and deserves the highest of punishments. I respect your position on the death penalty in general, but if you have a death penalty, I think this is just about as bad of a crime as a member of the armed forces can commit.
> "Is this important that I'm willing to die to leak it?"
In an ideal world, people should not be confronted with the do-The Right-Thing-and-die-for-it vs. business-as-usual dilemma. Not even after military training.
> he took specific oaths to protect his country and his fellow soldier.
Couldn't politically sabotaging this war (by leaking embarrassing videos and criminal backdoor political deals) be interpreted as making his country and colleagues safer by sending them home sooner? The invasion of Iraq is totally wrong, messed-up thing that in a reasonable world would never happen. Iraq was a mess before the war, but now it is a huge bombed-back-to-stone-age mess that badly needs cleaning. And I doubt a continued invading force can help with that. What Iraq needs is schools, law enforcement, separation of church and state, a functioning, modern, justice system and, hopefully, in one or two generations they will be back where they could be five years ago had a competent intervention been executed.
I am not advocating treason and I am not going into his apparently childish motives. It's unclear if people would really die from his actions. If you leak supply-run schedules for two months in the future, this hardly puts any lives in danger - the schedules just have to be changed (and if it becomes known the schedules were leaked, it creates a good opportunity to expose your military opposition)
As far as crimes go this whole war is an endless supply of them. If the US had to invade someone else random for what Afghanistan was supporting, it could as well be Mexico. It would, at least, make shipping tanks easier. Saddam was a Very Bad Person, but he wasn't stupid. It's safe to assume it would be possible to bend him to reason with a far smaller human price than an invasion.
And I think this is why we try not to discuss politics here...
> > "Is this important that I'm willing to die to leak it?"
Can't just quote out of context... there's a lot of other stuff around that quote...
> Couldn't politically sabotaging this war (by leaking embarrassing videos and criminal backdoor political deals) be interpreted as making his country and colleagues safer by sending them home sooner?
First, that's some pretty tortured logic. Second, he wasn't just leaking "embarassing videos and criminal backdoor political deals" - that's where the whole quoting out of context problem comes in. It'd be a lot more understandable if he was just releasing that sort of info - he said he "exfiltrating possibly the largest data spillage in American history" - he stole all sorts of info. That's the crazy-go-dangerous-reckless-endagerment-treason part right there. That's not the right thing to do.
> It's unclear if people would really die from his actions. If you leak supply-run schedules for two months in the future, this hardly puts any lives in danger - the schedules just have to be changed
In theory. In practice, there's millions of moving pieces in the war, and some things like best practices for specific events can't be changed. If he dumped everything classified he had access to, that'd be a HUGE benefit for people who want to kill the people he's serving with.
> And I think this is why we try not to discuss politics here...
Riddle me this, mate - does it feel weird making a comment supporting what this guy did in an earlier comment, and then responding to someone you disagree with saying that's why we try not to discuss politics? I mean, you're obviously a smart guy, but you're quoting me out of context, ignoring facts of what he did, commenting favorably and calling the guy brave, and then in response to a comment you disagree with you say this is why we don't discuss politics? C'mon man. I mean, if anyone cares, I wasn't at any point in favor of the Iraq invasion or ongoing war either, but a military analyst can't randomly steal classified data without flinching - maybe taking just the helicopter video could be sympathetic, but stealing random data like supply chains and timetables is totally unforgivably putting people's lives at risk for no good reason.
> Can't just quote out of context... there's a lot of other stuff around that quote...
I try to make quotes brief. It's always easy to go to the original message and acquire the context. A small quote serves as a pointer and should not be interpreted as the whole thing.
That said, the comment stands. It's not sane to demand people to choose between what's morally right (leaking the chopper video was right) and facing capital punishment. Others in his place would have leaked only the video and not other sensitive documents and could be charged with treason the same way as someone who leaks logistics to enemy operatives.
I agree the logic is tortured, but if you found yourself trapped in the middle of an unjust war (and this one is about as unjust as wars can possibly get) maybe the only sane alternative is to do your best to try to end it by the means you have. I agree not all the data he stole and leaked is at all relevant to the American people (the ones he swore to protect, I assume) and that they could cause lots of harm.
> In practice, there's millions of moving pieces in the war, and some things like best practices for specific events can't be changed.
So, creating an impossible situation would possibly make the war impossible to fight effectively and, with some luck, end it sooner. Mind you - for the hypothetical tortured soul I imagined for this exercise, whatever causes the earliest return of the troops home is the winning scenario. Under this, it doesn't matter who wins the war, as long as it ends quickly.
Manning was reckless in both ways - leaking material he should not have leaked (along with material he really should) to people he should not trust (who is to vouch for every anonymous analyst at Wikileaks?) and then bragging to someone he should never, ever, under no circumstances, trust. I have a little, just a little, sympathy for him, for the helicopter video. I may have some more if the leaked diplomatic dispatches lead to some cleaning of foreign policy. I have no sympathy for indiscriminate release of information that may endanger personnel whose worst offense is a perhaps questionable career choice that led them to the worst possible place to be.
Exposing the dirty secrets of a dirty war is important. It may start with urinating on toilet seats, but it may as well pass through having pleasure when you take down a target and may as well as go all the way up to entering a war on known faulty intelligence.
If I had access to (for whatever reasons) sensitive information, I wouldn't tell my wife. I wouldn't tell my mother. I wouldn't write it down.
note: I did some minor edits
another note: I seriously doubt the Wikileaks folks have access to anything Really Bad Guys don't.
Minor nit: the "while listening and lip-syncing Lady Gaga" I thought was cover for his CD-RW ostensibly containing Lady Gaga music, while actually containing classified data for export.
The rule is supposed to be no personal electronic devices in a secure environment -- this is one of the reasons! (the other reason is that a third-party could bug an electronic device, without your knowledge, and it would be really hard to detect. If it's a phone or smart device, it would even be possible to do in software)
> Manning was turned in late last month by a former computer hacker with whom he spoke online. In the course of their chats, Manning took credit for leaking a headline-making video of a helicopter attack that Wikileaks posted online in April.
What part of "trust no one" didn't he get?
You simply don't take credit for something that pisses off the very people who can throw you in jail and misplace the key.
It's a brave thing to do, the Right Thing to do, but it's also the thing you write in your memories, for publishing after you die.