CIA Chat Room Violates The Company's Policy 126
code_rage writes: "An article in the Washington Post says that some 160 employees and contractors of the CIA are being investigated for operating an unauthorized chat room. Two of those accused are "innovative, out-of-the-box, unconventional thinkers - these are essentially the hackers of the CIA, in the most positive sense of the word."
The article raises issues of national security, workplace monitoring, and worker's legal rights. Although security was not compromised in this case, the prospect of unauthorized software running on secure computers might be a little troubling. The article says that senior employees have a keystroke monitor installed on their computers. The 5-day timeline demanded by The Company for response to accusations, seems to preclude the employees the ability to consult with legal counsel, given that clearances take months to be approved."
/dns 216.206.242.164 (Score:1)
*** Resolved 216.206.242.164 to irc.fbi.gov.handed.me.an.o-line.st
--
Investigated for being in a chat room? (Score:1)
Re:Why punish their best people? (Score:1)
I do not work for any government agency, but I can well believe that the CIA, NSA, and other inteligence agencies screen with a fine tooth comb the software that goes into their networks. One little backdoor, or one little segment of code that sends logs outside the network is all that is needed for a potentialy serious breach of national security. And don't forget that lives can and are at stake. ICQ may seem harmless, but would you risk someone's life over it?
Working for the spooks sucks (Score:1)
Getting the best out of people (Score:3)
One or two employees and I could understand an investigation like this.
CIA or not, if 160 employees decide to break the rules in this way, isn't it just a sign that their employers aren't providing them with the (legitimate) resources to do their job effectively?
They could restrict these people and not get the best out of them, or they could work out a compromise. Since a lot of people are going to be watching this and it'll be setting an example to big dumb executives everywhere, I hope a compromise is what happens.
===
Re:Why punish their best people? (Score:1)
As always, with this kind of operation, the issue here is control. The Powers That Be in The Company must feel that they are "in control." Of their networks. Of their computers. Of their emplouees. Hell, of their paper clips! This kind of stuff gives them the willies.
I worked as a contractor for, shall we say, a player in the intellegence community a loooooong time ago, and let me tell you this: these guys have paranoia dribbled into their veins every night, right along with their maalox. Humor is not part of the job. Especially where computers are concerned.
These poor mooks are gonna get slammed, and slammed hard for their "innovation." The Company doesn't want stars, they want people who follow orders and procedures. When they get to the executive director level, maybe then they can get creative. Oh, but I forgot, at that level you're so political that any creativity outside of political survival is a liability...
As they said in "The Prisoner": "Be seeing you!"
Who says they haven't been given time? (Score:1)
In the original posting, it talks about this lack of time. It also says it almost exactly the same in the article itself: "The former officer said that by giving those under investigation only five days to respond to the charges against them, the CIA has 'effectively denied them the opportunity to seek legal counsel,' because lawyers typically must wait for months to obtain security clearances necessary to represent agency personnel." But again, six months is a long time. What were these people doing for the last six months? Especially the ones who had been suspended with pay? I would hope that they would spend that time doing everything in their power to seek legal counsel. If they waited until now to try, then maybe they should just face the consequences. I know that if I got caught breaking the rules like that on a secure computer system and was essentially told to not come to work until they figured out how they were going to punish me, I would spend the eight hours a day I would usually be working during trying to find a lawyer who could help me get out of trouble, regardless of whether or not what I did was wrong...that's just self-preservation.
Either way, that's what bugs me the most about this article: the claims that these people aren't getting a fair chance, when in fact they've had at least half a year to make whatever chance they wanted. And in all reality, this happened probably even twice that long ago, it just took six months for it to be dealt with, then six more for it to get to press and for the demands for explanations to be presented. Rip this apart as you please.
-G
Employee monitoring (slightly OT) (Score:1)
-Legion
Re:Employee monitoring (slightly OT) (Score:1)
I routinely check the back of my computer for keystroke monitors and I'm also planning to buy my own keyboard to work. I'll bring it in in the morning, use it during the day and replace it with the original keyboard at the end of the day.
Encrypting all your mail is also a good thing, but remember to store your private key only on a floppy disk. They might search your harddrive, so never ever copy the key there.
No, wait... (Score:1)
We weren't wasting time, or hacking cyber sex, or um.. something.
Re:Understanding a classified network (Score:1)
Re:They didn't have the bomb back then (Score:2)
From you second assertion, I seriously doubt you do know history. The primary purpose of American nuclear deterrence was to prevent the Soviets from dominating Western Europe. Southeast Asia and Asia in general were much less important as the Soviets concentrated their forces on their eastern borders
Re:Amazing (Score:1)
Re:They didn't have the bomb back then (Score:1)
No sleep for the truly paranoid... (Score:1)
Hypothesis: the chatroom was not a hack, but an undocumented feature.
Interesting that they're so certain nothing was compromised.
Re:Why punish their best people? (Score:1)
They were found out and exposed, supposedly by their own!!!!
Then made PUBLIC!!!!!!!!!!!!!
McArthyism raises it's ugly head.
A message is being sent to the rest of the serfs, toe the line or else.
Comments anyone?
So, who does the work now? (Score:2)
They don't say how many of them, but I guess we can assume that those who were suspended are at least the cream of the 160 that used the IRC.
What manager in his right state of mind can just suspend their best IT staffers - for six months?
Either they found someone else to do their jobs - which makes the discussion futile, cause then they will sack the offenders anyway - or, given that it's the CIA - they just leave the work undone...
Think about it. For six long months the creme of CIA techs doesn't get to work. Isn't that an invitation for everyone else to get busy while the yanks got their pants down?
I honestly do believe that the U.S. is the vulnerable to cyber warfare, simply because they have every man and his dog running through the Net.
Then they turn around and suspend the first line of defense, cause they were using their brains [which is what the CIA has hired them for, in the first place].
They should let h4x0rz run the Agencies. Would save them a pile and get more results...
Re:You're not there to Chat (Score:1)
Re:double standard??? (Score:2)
You're obviously not alone. I've never had a comment moderated around the block the way this one has. The comment was made tongue-in-cheek. I'm well aware of the gravity of the situation working for the CIA. When you go in there, you play by their rules, no exceptions. I just find the whole situation a little (black) humourous.
Re:Talk about FedWorld for you... (Score:1)
--
You think being a MIB is all voodoo mind control? You should see the paperwork!
Re:They didn't have the bomb back then (Score:1)
Not, he was correct in using eastern, as in eastern Europe. Actually, you're also neglecting to mention that the soviet union was preparing to push deep into Japan from the north up in Mongolia.
Well, you have to understand that the US and USSR had an agreement that they'll attack Japan (I don't think they agreed on when. Also, the Japanese did defeat the Russians in the Russo-Japanese War. If that had happened we would have faced a similarly divided Japan (except North being communist, south being free) as we saw in Germany after WWII. By dropping the two bombs they also didn't have to execute a full scale invasion of the island..
That's right, because we were the ones who were supposed to, not them. something that would have cost BOTH sides millions of lives, civilian and military.
Try looking up "Little Boy" and "Nagasaki". If you're going to spout revisionist history, at least study the actual events so you can sound more convincing.
I suggest you do the same.
What I wonder... (Score:1)
"Policy" vs. "Getting the Job Done" (Score:2)
If you have a job to do, you do it. If you try to go through all of the Proper Authorities, you'll have long grey whiskers by the time you get their formal rejection.
I'd be willing to bet that the "authorized" software on the computers in question was some version of Windows, Microsoft Office, and a couple of buggy, inconvienent, locally written Visual Basic programs for filling out timesheets and accessing databases. And nothing else.
I'm sure every Slashdotter has a list of extra programs that need to be installed on any Windows system to make it halfway usable. (The last "unauthorized" program that I loaded was bzip2. Big scary threat, that.)
The point of "policy" is generally to cover the arses of the Powers the Be; if anything goes wrong, it's because "somebody violated Policy". I have worked in a number of secure environments; I have never seen one where *all* the Policies were followed. Scenario: You're the only one in the office when you are hit with A Sudden Need. Do you (a) Shit in your pants, (b) Carefully collect all of the classified data from your desk (and everybody elses desk, if you're watching their stuff for them) and lock it in the safe. Don't forget to sign the logs, or (c) duck down the hall to the loo and hope that nobody notices. Policy, of course, says (b), with (a) as the only alternative. Of course, (c) would leave your classified data open to any Soviet spies[1] who happened to sneak past the armed guards at the gate.
It's not just the Government; look up Randall Schwartz [lightlink.com] to see just how bad it can get.
[1] Yeah, I know. There hasn't been a Soviet Union for ten years. The US Department of Defense and State Department (the CIA is part of the State Department) have been busily trying to put it back together, as it was the only justification for their existance.
--
Natalie Portman in the national record? (Score:1)
Re:Why punish their best people? (Score:1)
Actually a firewall does basically nothing if you are somewhat technical, which these people seem to be.
You could easily build a tunnel (e.g. VTun [sourceforge.net]) from the inside of a LAN to some point outside, and then have basically a VPN back in. I do that from where I work to my home. Even if your firewall blocks all direct connections, but have a HTTP or SOCKS proxy in place, there already exist tunnels that go through them.
My point about "judgement skills", though, was that these people are probably just as concerned as their management about security, and probably have much better grip on what it entails to make their network secure. Thus, if you are not going to trust them, you might as well make your network a complete island (whether they create such chatting channels, or not).
Re:I'm not sure you understand... (Score:1)
--------
Life is a race condition: your success or failure depends on whether you get the work done on time.
Human nature being what it is... (Score:3)
Of course they tried to hide what they were trying to do! What would have happened if they had gone to the brass and said, "Um, we'd like to set up a chat room on the computer network. Don't worry, we won't let anyone in without an invitation. And we certainly won't open up any security holes. Okay?"
For obvious reasons, CIA employees are required to abide by very strict rules governing, among other things, what they may and may not do, who they may and may not talk to, and where they may and may not go. These rules are meant to be followed to the letter (the former director who used his home computer to create a top-secret document notwithstanding). Any violation of these rules means that security may have been compromised. I'm sure that potential security breaches worry the CIA brass just as much as actual ones, because when you find a hole, you really can't be certain that something didn't get in or get out through it.
Unfortunately, the above rules conflict with basic human nature. We are inquisitive animals, and we want to explore systems, whether they are computer systems, social systems, philsophical systems, etc. As soon as people are told not to do something (especially if they aren't told the (real) reason for the rule), they become even more interested in the forbidden behaviour than they were before. If you restrict a person's freedom to explore, there is always the chance that he will go ahead and explore anyway, and if he's smart, he'll go to great lengths to avoid detection of his activities. (Hmmm ... sounds like one of the prerequisites for becoming a spook. Maybe they should give these guys medals.)
I'm not really surprised that this happened, but if the CIA were really as paranoid about security as they should be, this would have been uncovered much sooner.
Re:I'm not sure you understand... (Score:2)
What is the great danger of running a chat server again? Who was it that was going to 'root' their box?
Most of the data is probably on a need to know basis and compartmentalized on the systems. In this case, outside means from one office to the next. The idea is that even with the best background checks, someone could manage to slip in. The less each person is told, the less they could leak. The IRC server probably violated the compartmentalization (at least potentially).
Re:Policy (Score:1)
Nope but I get permission to look at it.
Re:Why punish their best people? (Score:5)
- The CIA network, by its very nature, must be one of the secure LANs in the world. By installing unapproved software on an unapproved server, they may have inadvertently placed the security of the entire network at risk. While the article dosn't specifically mention what software was used, I seriously doubt that a security audit was performed on the source to verify that it wouldn't open up any holes.
- The chat room created the potential for inadvertent security leaks by allowing unmonitored communications between non-authenticated personnell. Think about it this example, two CIA buddies regularly converse via this chat room during their lunch hours. One day, someone else (either internal or external to their network) gains access to the chat room and masquerades as one of the two regular users. When the other guy comes on, he sees the screen name and automatically assumes that it's his buddy, mentally placing him in the trusted category. Now, when this guy asks him what he's doing today, he probably wont think twice about telling him. Voila, he's just breached national security without realizing it.
As I said above, these guys should be disciplined, and they should probably be forced to re-take the security training classes, but they have showed creativity by solving what they saw as a communications "problem", and by keeping it operational on a heavily secured and monitored network for over a year without detection. These sound like the kinds of guys who would make excellent electronic intelligence agents.But the real question is... (Score:1)
Re:Why punish their best people? (Score:1)
Understanding a classified network (Score:3)
Although it might not seem right at first, these employee should be punished as this was a true security violation. The best way to secure a network is to not to avoid things that are known to be unsafe, but only allow things that are known to be safe.
The Company/a company (Score:2)
It is not too hard for me to imagine a company freaking out if an employee, without permission of IT or whoever, set up an IRC chat server within the company network to chat with coworkers.
I've dealt with (but not worked directly for) companies in that past that won't allow their employees to even run IM clients like AIM or ICQ due to fear of them wasting time and goofing off...Having an internal server running on a company system without permission just adds (in the PHB's mind) to the inappropriateness of that goofing-off action.
Countries need secrets (Score:2)
Re:Two ways to see it (Score:1)
May not have right ot legal counsel (Score:2)
The Company for response to accusations, seems to preclude the employees the ability to consult with legal counsel, given that clearances take months to be approved
For the job I'm currently working, I had to sign an Employee Dispute Resolution agreement. It basically says that I can't sue them and they can't sue me until we have gone through a resolution process, which involves at some stage an outside mediator. The result is that most disputes are handled internally, without causing harm to the company while still providing a resolution satisfactory to the employee. Signing this made me very nervous, needless to say, but after reviewing the procedure, it seemed reasonable to me.
The point is, if my non-Top Secret company had such an agreement, it wouldn't surprise me if the CIA, a group which would be very concerned about public resolution of disputes, had such an agreement.
Re:Who says they haven't been given time? (Score:2)
I mean, seriously. THe people involved her have security clearance, are supposed to be EXTREMELY WELL TRUSTED.
Finding out they did something that was against policy.. what do you expect?
Besides.. they don't *NEED* to consult with legal council; nobody's putting them on trial!
Control@USA (Score:1)
Re:Who says they haven't been given time? (Score:1)
And yes, you're right, they would have to get security clearance. The thing is, the article is claiming that they weren't allowed time. That's what bugs me: that it's claiming they were only given five days from start to finish, instead of the actual six months (at least) that this has been going on. These people knew they were in trouble of some sort six months ago when they were suspended. If they were going to seek legal counsel, they should have done it then, not waited until they were ordered to turn in a written explanation of their actions.
Basically, all that I'm saying is that whoever said they weren't given time to consult is wrong, and that whatever trouble these people get in to for not consulting over the period of those six months is their own fault.
-G
Work & Life (Score:1)
What contract... hey those contracts are just a bit of bureucracy, nobody cares about them in real world.
Re:Control@USA (Score:1)
Okay, so call me two-faced.... (Score:1)
Re:Employee monitoring (slightly OT) (Score:2)
Do you think the hardware keystroke monitor you look for in the back of your computer can't just as easily be incorporated into the motherboard? These corporations have deep pockets...
That's old shit man. What do I do?
A) I use special goggles (LCD ones that emit NO radiation someone might peek at to follow the refresh cycle)...but, of course, you can't just plug that into a computer! They could have the video card tapped!
No, what these bad babies do is run strong encryption on anything they see that has their "encryption tag" on it...Anything on the computer screen between certain tags (they look like funky barcodes) is translated using 128-bit RSA encryption into a corresponding real image. They work within a 100 degree field of view, take megapixel shots, and analyze them surprisingly fast (you get like 3 fps), putting them back in the same aspect they were originally in. So you end up with a screen that has part of it looking like it has static on it, the rest normal. When you put on the goggles, you get the static stuff to look normal, except only changing about three times per second. Naturally, the rest of the goggles (the part not doing any unencrypting) have good refresh rates, so everything else looks the same as without the glasses.
B) But then, of course, it's not enough to have the computer print out garbled (encrypted) output, They could just have memory snoops! So, what I do, is I run NOTHING on my local machine. I run it all off of a server I have set up at home for which I have, essentially a custom remote access tool, which will serve you a page that via java gets the garbled screen (that is, its not even sent out unencrypted) and puts it out on your screen. Of course, it doesn't get plaintext keyboard/mouse commands, either, which brings me to
C) I use a special mouse and keyboard which both strong-encrypt (again, 128-bit) every keystroke and mouse-movement (each key ends up sending a few hundred, each mouse movement, too, since for java reasons I send only ASCII text keys and translate everything into that), and so it's no problem if They see exactly what's sent out from the keyboard...They'd have to see the keyboard physically to know what keys I'm hitting....which, of course, They can't, because I cover the whole portion of my desk that I type over with a thick blanket of industrial-level (not just medical-level) radiation shielding that blocks all visual clues to where my hands are, as well as infrared and xray. Not even radio noise escapes, which might otherwise let them analyze what the keyboard does internally. A portion of the shileding even goes all the way to my elbows, so They can't analyze the muscle movement of my forearms to see what keys I might be pressing.
D) The mouse and keyboard have a private key based on the goggle's changing public key, and my home server invalidates them every 15 seconds, so that when the goggle is not connected to the keyboard/mouse, or to put it another way, if the keyboard and mouse are every picked up by Them and anaylzed, They won't be able to talk with my server anymore. So how does the goggle get its private key? Based on both 1) scanning my retina, which alone isn't enough, of course, since They could also do that and get my private key anytime, but also 2) having a SHIELDED component that accepts a miniture disk with closed casing that's light-encoded, so that with a single motion I can destroy all data on it by exposing it to light.
Now, granted, it might seem excessive to spend upwards of $75,000 on equipment only to end up wearing this heavy goggle set physically connected to a keyboard and mouse that are all under heavy xray/radio/infrared shielding, but, gentlemen, I assure you, with my setup, I can be totally 100% sure that my Company has absolutely no idea that I'm really just playing Quake. And that kind of peace of mind, my friends, is worth 3 fps.
Re:Understanding a classified network (Score:3)
Has anyone ever actually tried to audit Emacs for security?
Has anyone made any real effort to assure there aren't any dumb bugs in, say, the emacs built-in news reader that might allow a malicious news message to run arbitrary emacs code? Are we sure there aren't any bugs in Emac's C source parser, formatter, and x-ref facility that might allow arbitrary emacs code to be run? Has someone checked the vi emulation package with a fine tooth comb? What about the built in mail reader? What about the built-in Zippy the PinHead quote generator? What about the Eliza package? What about the Emacs web browser? Do I have any assurance that a malicious web page can't run arbitrary emacs code? What about the Emacs Slashdot reader? Is that secure?
I guess what I'm saying is that Emacs is a huge beast of a program. It contains its own nifty little byte code virtual machine with a lot of nifty hooks into your environment, and its own nifty lisp compiler that targets that virtual machine, and its designed to be easily extendable by its users, loading and running new code into that virtual machine at the drop of a hat. Its a great program if you like to reprogram your editor while you edit. Heck, you can even easily let your documents reprogram your editor, if you use the file-local-variable stuff. But has anyone examined Emacs closely to determine if any of the things Emacs does are all done securely?
Re:Countries need secrets (Score:2)
We didn't either before dropping two on civilian populations. Even then, it took the media to report all those horrible effects that the bomb had on those exposed to the radiation and the environment before we Americans realized the horrors we unleashed. Apparently, China has yet to drop a single one on people.
China (Score:2)
Re:double standard??? (Score:1)
Ha! So helping rebels overthrow their government is part of the national security of the UNITED STATES? So, tell me, do you also believe in Santa Claus?
And you would do what? (Score:2)
And you would do what? Slap chains around their ankles? If you didn't get riots you'd get some quite demoralised and less effective workers. They should be (and hopefully are) trying to work out what's wrong with the working conditions that caused people to do that -- not slapping punishments on everyone, demoralising them even further.
What I'm trying to say is that if 160 people are breaking the rules, obviously the rules aren't designed well enough to accomodate people effectively. When rules are made too inflexible to fit people, they'll get broken and so there's not much point in having them anyway. Show a bit of respect by allocating some freedom for people and they'll usually surprise you.
The CIA is a special case and there would be some specific things that couldn't do, but it's in everyone's best interests that the people working there are enjoying what they do. For example, if they don't want unchecked s/w running on their network, perhaps they need to create a seperate intranet where employees can run unchecked s/w.
===
You're not there to Chat (Score:1)
Wouldn't you be mad if you went to the DMV to take a driving test, and they said, "Come back Friday, I'm in a chatroom right now...?"
--
No! (At least not necessarily) (Score:1)
Anyway, no one gets an account on our network without a clearance. It's not a big deal to install software on the intranet because you can't unknowingly open a hole to the Internet or SIPRNET -- they're not connected. And there's no uncleared personnel with accounts. (shudder.) The network links cannot be monitored without breaking the military-grade encryption.
I would assume that the CIA likewise does not have any uncleared personnel on their network, so the scenario you propose does not apply.
Re:Talk about FedWorld for you... (Score:1)
Sorry, I have to disagree. Consider this: Every second those "hackers" spend on chat/irc/etc. is a second wasted when they could be doing something constructive, like, their job.
Counter Strike would be unauthorized! (Score:1)
It has been months since I've made it through the day without either using IRC
or playing a few (10 or 20) rounds in Counter Strike.
I work at an educational institution. Particularly, one with a limited amount of intelligence.
Don't trust the spoons.
Shhhh.... (Score:5)
"Don't be paranoid, what do you think this is, the NSA?"
Re:Control@USA (Score:1)
Get back in your box *thwap* (Score:3)
Someone at our government being unconventional? whoa....whoda thunk it?
But really, these people work at the CIA, did they think they wouldn't get caught? or were they expecting to lose their laptops before they did get caught.....
Two ways to see it (Score:1)
I'm not sure you understand... (Score:1)
In these days, people expect that all networks are connected somehow, because the Internet is so ubiquitous. But this wasn't always true. I'll lay down good money that the CIA's internal network isn't connected to anything else. The people on the network all have clearances. The connections on the network are all encrypted.
Now, I don't know how strict the CIA is about their policies... but consider: Suppose there are 200 computers networked together inside the CIA headquarters in a secure area (accredited for open-storage of classified information). Those computers aren't connected to anything else. The hard drives are removed from the computers and locked in safes when not in use. There are alarm systems with motion sensors and armed guards. To get an account on the network requires having a clearance on file. What is the great danger of running a chat server again? Who was it that was going to 'root' their box?
I don't work for the CIA, but I do work in an environment similar to this. Don't make assumptions about their security by comparing it to something you're familiar with.
And you expect understanding from the CIA? (Score:2)
Now here's a perfect double standard. Fuck with the enemy's systems, and we'll give you a medal. Do the same with ours, and we'll shoot your ass. The funny part is that it was a chat room. Chat rooms are forums for essentially free speech. So the enemy probably would shoot you for attempting to practice your right to free speech. Thus, we have a situation here where they'd be damned by both sides.
This has all the smell of bad political infighting. As the Washington Post article points out, it seems "highly suspicious that all of those supervisors, not to mention the numerous component network administrators and security personnel, were unaware over a period of years of illicit computer usage by a group of 160 personnel". So something happens, and somebody who does know about this particular skeleton digs it up and uses it against "several officials, including members of the Senior Intelligence Service, a cadre of career officers at the upper reaches of the civil service system". They wind up with letters of repremand in their folders or worse, fired. In any event I strongly suspect there's a lot more going on that we don't know about - yet.
Re:FP (Score:2)
Spy Agency Investigating 160 Employees, Contract Workers for Unapproved Site [tbo.com]
WASHINGTON (AP) - The CIA is investigating 160 of its employees and contract workers for exchanging "inappropriate" and off-color messages on a covert "chat room" in the spy agency's classified computer network, The Washington Post reported.
more [tbo.com]
--
Re:You're not there to Chat (Score:1)
Why punish their best people? (Score:4)
Seems like these guys are really good resources to understand and deal with computer crimes and other computer-related operations. Why would CIA want to criminalize them, leaving only meek people behind? Sure, that's gotta make them more savvy and efficient as an organization.
Seems to me that what these people were doing is pretty harmless from a national security point of view. If their management does not trust their intentions and their judgement skills, they should not have hired them in the first place.
Now, instead, they will make CIA an organization only for dead weights.
Re:Two ways to see it (Score:3)
And the chat room's subject would be.... (Score:5)
Re:You're not there to Chat (Score:1)
Re:double standard??? (Score:1)
If you work for the CIA, things that you do to further US national security, even if they might harm Russia to some degree, are rewarded by the US. Part of the CIA's job is to find out things about Russia that the KGB might not want to tell the US.
On the other hand, if you work for the CIA, things that might *harm* the US are punishable, and should be. There is a fundamental asymmetry between Russia's interests and America's interests that distinguishes between these actions.
I find it quite naive of you to suggest that this is primarily a free speech issue. The CIA does not provide computers and networks to further their employees' free expression. In fact, public expressions of secret information are often punishable, regardless of the First Amendment, because, according to the classifying authorities, such disclosure would cause some harm, or risk of harm, to the US's national security. I am sure that the CIA employees have had this explained to them, and agreed in a legally binding way. Your First Amendment arguments are a red herring.
Chat rooms are potentially forums for exchanging *information*, and *information* is what the CIA deals in. Furthermore, installing this software creates connections that might allow the network to be accessed from the outside, which is an additional risk.
I don't understand at all what you mean about the enemy "shooting you" for practicing free speech.
I don't disagree that there is some bureaucratic infighting going on. What do you expect in a government bureaucracy? Some sort of utopia for hackers and "free" speech?
Everytime I feel compelled to explain things this obvious, I worry that I've been trolled.
Re:And you expect understanding from the CIA? (Score:2)
Re:d00d, so sorry you. (Score:1)
Not a surprise (Score:4)
I found it interesting, that the article said, "...which CIA investigators discovered while performing routine computer security checks..." Then later said, "...'This activity has apparently been taking place for some time...'" If it was a routine check, then shouldn't they have caught it before it got out of hand? The only reason they didn't, that I can think of, is they wanted to catch the guilty parties involved. I don't feel sorry for any of the parties involved because they breached their contract.
Re: (Score:1)
Re:Why punish their best people? (Score:1)
I read this because my original somehow got moderated up :o
Yeah, I want people who can follow orders working for Our Intellegence Community too. (*sigh*) I guess I can't have my cake and eat it, too...
Re:No! (At least not necessarily) (Score:1)
Details (Score:1)
Illicit computer usage (Score:1)
The rest of us are disgusted at the use of the word illicit.
practice (Score:1)
were here to defend democracy, not practice it
FunOne
Instead of punishing them... (Score:1)
I can see it now: "Use CIA-IRC, the server used internally by the CIA!" Give the hackers a kickback, keep the rest of they money to fund black bag ops or something.
Re:I'm Missing The Problem (Score:1)
who are these twits? how many of us would do this without permission at our places of employment?
I don't find this incredibly newsworthy, other than the fact that operating something like a chat room just provides yet another hole that some unscrupulous person could use to gain access to information. At my place of employment, that would most likely be data about something ridiculous like cat food or toilet paper. At the CIA, the information that they could gain access to is MUCH more sensitive. I applaud any disciplinary action against these two "hackers".
PS
Re:Amazing (Score:2)
Perl.
Get a grip (Score:2)
In this case, it wasn't just "unathorized use." The chat room was inside a classified network. Even though the CIA admitted that nothing was compromised, in due time, it may have been. Having a publicly-accessible chat room on a network just like the CIA's is an invitation to jump into the network, and that's a big security no-no.
Read the article next time. HTH HAND
--
They didn't have the bomb back then (Score:1)
Yes I do know history and I believe that using the bomb was a necessary political meanuver to prevent from having the soviet union have a massive foothold in southeast Asia.
Re:Employee monitoring (slightly OT) (Score:1)
Re:Countries need secrets (Score:1)
China may be more likely than most to use the bombs, but that does not mean that they will sleep easily. Whoever gives the order knows that tens of thousands of innocents will die, too, and while it's possible to assert that "the enemy" has no ethical block to using such weapons, I'd invite you to examine the suicide rate of anyone responsible for the launch anywhere in the chain of command that survives the inevitable response.
Re:Virtual Water Cooler (Score:1)
A smart manager would have made sure that the work environment is such as not to make it necessary for the employees to install gunauthorized softwareh in the first place.
Re:Why punish their best people? (Score:2)
Well, yeah, they must not only feel it, it must be TRUE for them to do their job effectively! What are they, the Boy Scouts? It's a US government intelligence agency, for Pete's sake!
Either secrets are worth keeping, or they are not. The CIA must maintain solid control over its infosystems. What's so hard to understand about that?
Would you let a luser make arbitrary modifications to inetd.conf, install their own CGIs or just su to root whenever they felt like it?
>The Company doesn't want stars, they want people who follow orders and procedures.
Good. I want that at the CIA too. Those guys have an important job, and they should do it right. They aren't paid to chat each other up in some stupid non-approved app.
Re:Policy (Score:1)
Err, reading Slashdot is an efficient means through which I can stay current on various developments within the computing industry, thus allowing me to more effectively do my job. At least that's the rationalization that I'm sticking with.
It's not National Security (Score:1)
Re:You're not there to Chat (Score:1)
Or, maybe they do suck at what they do and have us think that they suck at what they do so that we think they don't suck.....erm...that didn't make sense.
Re:Two ways to see it (Score:3)
As the Captian from Chrimson Tide put it so elequently:
were here to defend democracy, not uphold it.
mission improbable (Score:2)
They need a training groung (Score:2)
Policy (Score:3)
Re:Policy (Score:5)
Wait a minute? Is Slashdot considered work related?
Gotta go!
"Media Making Big Deal Out of Nothing" (Score:3)
Think about it: they ran a public server from an internal network that has access to sensitive information. This is very bad, security-wise. What would happen if somebody outside rooted their box? Depending on the information that could be accessed, people could die because some morons were running some IRC server.
This wouldn't be the first organization that's fired employees for breaking the security policy. This story fills me with nausea.
--------
Life is a race condition: your success or failure depends on whether you get the work done on time.
Keystroke Monitoring Risk (Score:2)
Virtual Water Cooler (Score:3)
I'm just waiting for the day when everyone gets a neural implant that automatically detects non-business related thoughts during company hours. After all, we provide the air that you breath. It is against company policy for anyone to have independent thoughts while breathing the company's air.
Just because you can legally treat your employees like serfs doesn't mean that you are obligated to do so.
A smart manager might ask, Why was this software installed and why was it so popular?
Re:Two ways to see it (Score:2)
Good point. The CIA might have situations where they depend upon compartmentalization: they might give the same data to two groups and compare the results, or they might give pieces of the data to different groups in an attempt to disguise a common origin. The organization may prefer for information to not leak between groups.
Re:You're not there to Chat (Score:2)
I'm Missing The Problem (Score:5)
The CIA is investigating 160 employees and contractors for exchanging "inappropriate" e-mail and off-color jokes in a secret chat room created within the agency's classified computer network and hidden from management.
And then it says:
If they were doing this with the KGB's computer system, we'd be giving them medals. Sadly, it was ours.
Umm, if they were sending around dirty e-mails and fart jokes around KGB computer systems, I doubt we'd be giving them a medal. I think it'd be more like "Why were you dicking around on their computer systems and not gathering information?"
And how come everyone who "thinks outside of the box" is automatically a geek and a hacker? Where I work (which is not the CIA), we reward people who think outside of the box, but we'll also fire in a heartbeat those people who abuse our systems, even if it's something minor. Why? The reason is that when someone abuses something for a harmless reason, there's no reason that they might someday cross the line and abuse it in a very damaging way. It's about responsibility and decision making capabilities. If they can't conduct themselves in a responsible manner, they're a potential liability. Whether they think "outside of the box" or not is irrelevant. Conduct and action do not have an effect on the ability to solve problems.
Frankly, I'm glad that the CIA is watching their internal networks and trying to maintain good employee conduct. I wouldn't want some care-free hacker in charge of maintaining information that, if put in the wrong hands, could endanger the welfare of the country, just like I wouldn't want some carefree hacker on my computer network doing things that could possibly make my work day more hectic.
Re:Shhhh.... (Score:4)
"Just what the hell are you looking at? Is that a picture of a man spreading his asscheeks?"
Re:Two ways to see it (Score:2)
if senior employees have keystrokes monitors, that means that all communication between them is 'official' and vetted by their back-of-the-head-lawyer. This should be devastating in an organization whose purpose it to evaluate and analize information.
There a tradeoff here between security and being able to successfully do the job. Out of fear of scandal and the desire to cover their ass the CIA has compromised its usefulness in the interest of security ( job security mostly).
At the end of the day, the price of this attitude is dead Americans in botched or badly conceived missions.