Why David Petraeus’s Gmail account is a national security issue

http://www.washingtonpost.com/blogs/worldviews/wp/2012/11/10/why-david-petraeuss-gmail-account-is-a-national-security-issue/

by steve8918 • 14 years ago

87 58 14 years ago

washingtonpost.com

rpm4321• 14 years ago

Who knows if it's accurate, but Buzzfeed is reporting that it may have been Anonymous as part of its Stratfor attack:

http://www.buzzfeed.com/zekejmiller/anonymous-may-have-hacke...

kinble32• 14 years ago

I doubt it.

Zigurd• 14 years ago

The news story there claims the first step in this scandal was that Paula Broadwell's yahoo account was compromised. That's not too hard if you can guess her password hints.

The next step, it seems, was sending some trolling emails. That requires acquiring or just guessing some email addresses. The people who got the trolling emails set the discovery of the affair in motion. Well played. But did not require a 133t hAx0r.

staunch• 14 years ago

If I was a foreign government I'd have multiple spies working inside Google by now.

thechut• 14 years ago

I'm sure the US government DOES have spies working inside Google as we speak

jballanc• 14 years ago

I'm sure the US doesn't need to bother wasting the resources required to train and embed a spy when a lawyer with a subpoena will do...

GHFigs• 14 years ago

You're sure?

ImprovedSilence• 14 years ago

I'm sure the US doesn't need spys working in Google. I'm sure there is systemic collaboration with the NSA, to the point where they don't need spys "working" for google. Also, I think actual spys are placed much closer to personal sources of information, not technical. If that makes any sense. I guess I'm trying to say is, if you are going after computer information, you're going to get it from the outside. If you're going after people information, you're going to have a guy on the ground.

walshemj6• 14 years ago

One would hope that the US has something like list X status for companies that are sensitive (and telcos and coms companys are) and have senior people and those with acess to sensitive information vetted.

I know a senior developer in British telecom who worked on the system that tracks every private circuit in the UK and she was being PV'd (positively vetted its called developed vetting these days) - as she had root access to this system same as being TS cleared in the USA.

danso2• 14 years ago

Well, Petraeus gets a +1 for not using his official e-mail account, or an old DoD account for this. In fact, it's kind of pleasantly surprising that he used GMail over...say, an aol.com address.

In fact, it seems that for any given government official who wants to conduct risky non-official business, using something like GMail would actually be the more secure route, if you were trying to keep secrets from both your employer (which includes the public and public record requests) AND from the usual enemies of the state.

If both Petraeus and Broadwell had used GMail accounts not associated with their names, such Dave501010@gmail.com and PaulSmith900@gmail.com, how likely is it that anyone would discover their shenanigans? For an enemy of the state to find out, it would have to compromise both GMail and somehow connect Dave501010@gmail.com with David Petraeus. Sure, it's security through obscurity, but we're talking a nearly unsurmountable amount of obscurity.

Of course, once they start forwarding emails from their private account to their publicly known addresses, then the game is riskier. There's also the problem of keeping the ruse without making an AutoComplete mistake, such as sending a message from petraeus@cia.gov to PaulSmith900@gmail.com without realizing he's logged in as petraeus@cia.gov.

toomuchtodo3• 14 years ago

I argue that mail clients should have a blacklist option: When logged in as account X, NEVER permit me to send email to email address Y.

Daniel_Newby• 14 years ago

The blacklist can be compromised, which is a larger vulnerability than having no blacklist.

paganel• 14 years ago

> If both Petraeus and Broadwell had used GMail accounts not associated with their names, such Dave501010@gmail.com and PaulSmith900@gmail.com, how likely is it that anyone would discover their shenanigans?

I'd argue that every security agency worth its salt is also keeping a close watch on its bosses (especially on its bosses) so that let's say if Petraeus had logged in with joe.doe@gmail.com his communications being intercepted someone would have noticed. As a non-American, I'm not exactly sure what's for example the relation between the NSA and CIA, but I guess it's somehow telling that the whole thing seems to have been driven by the FBI

danso2• 14 years ago

According to the NYT, the revelation was due to the emails being forwarded from Broadwell. So as almost always is the case in real life, it seems the security breach was through a social lapse, not through a technical obstacle. And it was not movie-like/CSI-level sleuthing, but just an accident, that the authorities found out

http://nyti.ms/RLx6QT

> WASHINGTON — The F.B.I. investigation that led to the resignation of David H. Petraeus as C.I.A. director on Friday began with a complaint several months ago about “harassing” e-mails sent by Paula Broadwell, Mr. Petraeus’s biographer, to an unidentified third person, a government official briefed on the case said Saturday.

joonix• 14 years ago

NSA seems very low profile and I'm not sure they are capable of enforcement. They probably got wind and passed it to FBI. Just speculating here.

sliverstorm• 14 years ago

Sure, it's security through obscurity...

IMO, there's nothing wrong with a little security through obscurity if:

1) It's not your main game plan, just an extra obstacle. Anything can be compromised eventually, so you buy extra margin.

2) The obscurity is agile. Similar to benchmarking password complexity vs. projected brute-force capabilities of enemies and rotating passwords accordingly, rotate the obscurity- acknowledge that your enemies will figure it out eventually, and change it up faster than you think they can figure it out.

icelancer• 14 years ago

Right. It's a solid defense-in-depth marker that usually isn't too costly to implement and adds more time/effort to the equation. As long as you recognize it for what it is, it's OK.

guylhem• 14 years ago

An aol address is hipster chic.

It also makes a good april fool joke - if you still have one matching your name, just send a message on Apr 1 to your geek buddies explaining you are moving from gmail.com/outlook.com/whatever to aol, and wait for the "WTF?" replies :-)

larrys• 14 years ago

"without making an AutoComplete mistake"

Of course for such a high risk relationship it wouldn't have been a big deal to purchase 2 laptops that are only used for this particular communication and nothing else (no web surfing nothing, just to setup an email account to communicate with the other party). That way, no risk of auto complete and can avoid any other traces and be easily destroyed. Doesn't avoid any IP address matching but that can be handled in other ways.

mayneack2• 14 years ago

I think that's pretty standard. I have a friend at a much lower level TS position that has 3 separate computers for varying levels of activity.

ricardobeat2• 14 years ago

He wasn't even using two-factor authentication?

eigenvector• 14 years ago

How would two-factor authentication stop the FBI from lawfully demanding your email from Google?

ricardobeat2• 14 years ago

His mistress accessed his e-mail first, not the FBI.

dror• 14 years ago

There's a log of bogus assumptions in these articles, and he got caught because she was investigated, not him.

If he used a gmail account and used a separate device such as a private smart phone or tablet to access that account there would have been zero vulnerability, other than the fact that he could have been blackmailed. Gmail is pretty hard to hack into, the IP address of the device probably wouldn't tell anyone anything about where he is, since it's a private IP on the telco (can you tell a person's location from the IP on the telco?), and there wouldn't be any way to get to any of his secure accounts or make a mistake of using the wrong email account.

patrickgzill• 14 years ago

Telco's log everything! So it would not have been difficult, if you could connect the phone number to him, to track everything else.

mynameishere• 14 years ago

Petraeus's personal email should be no more sensitive than the mailbox outside his house, which any junkie could "hack". If he put classified information on google's servers, that's a whole different problem. This is a non-issue and a distraction from the real reason why he was forced out.

pemulis• 14 years ago

That depends on what he used the e-mail address for. If it was strictly for romantic liaisons, it's no big deal. But if he used it for any other purpose (talking with his lawyer, chatting with senators, etc.), it would be a hell of a platform for social engineering attacks. In that scenario, the information in Petraeus' personal inbox is beside the point[1]; you can use the trusted address to get your hooks into something more interesting.

[1] Ignoring the blackmail value of the affair.

kposehn• 14 years ago

The most likely explanation is that she accessed his smartphone or computer when he was not looking.

mayneack2• 14 years ago

Sounds like Janet Napolitano has the right idea.

http://techdailydose.nationaljournal.com/2012/09/napolitano-...

ChristianMarks• 14 years ago

Obviously Google should delete David Petraeus's account immediately. National security is at stake!

;)

fleitz• 14 years ago

Yes, in the hands of voters that kind of information could ruin an administration. He should definitely be fired lest the public find out what the CIA is upto.

Why David Petraeus’s Gmail account is a national security issue

Related Stories