NSA Implementing 'Two-Person' Rule To Stop The Next Edward Snowden

http://www.forbes.com/sites/andygreenberg/2013/06/18/nsa-director-says-agency-implementing-two-person-rule-to-stop-the-next-edward-snowden

by juvoni • 13 years ago

160 123 13 years ago

forbes.com

PavlovsCat2• 13 years ago

where you are <---> Rubicon <---> where a sane person would want to be

PavlovsCat2• 13 years ago

Yeah, yeah. Yawn. I'm not hearing any words ;)

meritt• 13 years ago

"make sure that if another person were to turn against his or her country"

http://en.wikipedia.org/wiki/Dutch_Ruppersberger

Dear Maryland: Please vote intelligently at your next opportunity.

hfanson1• 13 years ago

Looks like he won the seat in a gerrymandered district. This manipulation of district boundaries takes advantage of people who vote along party lines regardless of an individual candidate's qualifications.

hga• 13 years ago

Exquisitely gerrymandered. Wikipedia closes with this note on the current one:

"In 2012 the district was found to be the eleventh least compact congressional district in the United States."

And a link to this article, which shows that district, and is titled "Maryland has least compact congressional districts in nation": http://marylandreporter.com/2012/10/03/maryland-has-least-co...

Now, in all fairness they do have a cragy coast, but it is very clear the districts are unconscionably gamed.

alexqgb• 13 years ago

This point simply cannot be overstated. The absolutely deplorable level of "oversight" performed by Congress is a direct function of the degree to which they've been able to insulate themselves from the electorate. Being able to select who can and can't vote against them is one of their most effective means for doing this. Indeed, this practice explains why so many of them can hold onto their seats while continuing to act against the interests of their constituents in ways beneficial to their funders.

In short, gerrymandering, closed primaries, and private campaign finance form the Triangle of Doom. In combination, they provide the noose with which Congress is choking America to death. Abuse at the hands of the NSA (and their multi-billion dollar web of contractors) is just the latest, and perhaps the most chilling example of this phenomena.

saalweachter6• 13 years ago

Primary elections, primary elections, primary elections.

Primary him. Primary him credibly. Primary him principally on this issue.

chm• 13 years ago

“When one of those persons misuses their authority it’s a huge problem.”

But of course, this doesn't apply to the Government.

Why can't someone in power admit that surveillance has gotten out of bounds, maybe illegally, rather than devise ways to counter such divulgations?

rfnslyr2• 13 years ago

Nobody cares about anything unless it disturbs their daily rituals. At the end of the day, if they are still able to go to work, collect a paycheck, watch a movie, see their family, they aren't going to care.

Similarly with government workers. They don't care. They want a paycheck. It's not their fault, it's somebody else.

Until the government starts pointing fingers, nothing is going to happen.

We've been carefully coaxed into complacency.

rayiner• 13 years ago

We've been carefully coaxed into complacency.

Or, we rationally process the information we have and conclude that we're okay with the status quo.

jivatmanx• 13 years ago

The Roman republic actually did have a copresidency (two consuls).

jlgreco2• 13 years ago

They also had a functional Dictatorship system. Well, functional for a time... until it went wrong. I think they were actually onto something with that idea though. The flaws likely could have been corrected. A common theme with most dictatorships gone awry is a rogue general, but the real problem is a military comprised of men that are willing to follow a rogue general.

throwaway10001• 13 years ago

Hey Booz Allen, we need another 6000 analysts to double team your other 6000 analysts.

Truly yours,

Current NSA Chief, and future Booz Allen Hamilton CEO.

rhizome• 13 years ago

"...and we will pay handsomely for this requirement."

blahyawnblah• 13 years ago

"The rule required that anyone copying data from a secure network onto portable storage media does so with a second person who ensures he or she isn’t also collecting unauthorized data."

Don't mind me over here by myself, I'm not copying anything...

jessaustin• 13 years ago

Hmmm. The impression I have is that Snowden had access as a sysadmin, not as an analyst. That is, he didn't really have any duties that called for him to access the "secret" data. If the systems allow sysadmins to bypass proper authorization procedures, what good is another authorization procedure? Perhaps they'd be better off auditing the ACLs. In the Cloud Era, very few machines ever need to allow root access.

However, this scheme would seem to prevent previous "laptop leaks", so I think it's a good idea.

spikels• 13 years ago

Now Sunday's oddly worded press release makes more sense:

"The statement that a SINGLE analyst can eavesdrop on domestic communications without proper legal authorization is incorrect"

http://www.dni.gov/index.php/newsroom/press-releases/191-pre...

jrochkind12• 13 years ago

Or perhaps the emphasis should be on ANALYST. An Analyst maybe not, a sysadmin, oh, yeah, sure (and we have about 1000 of those).

But really, I don't believe anything they say, or believe that I'm capable of figuring out the true meaning of the careful wording that they think they are using to 'technically' tell the truth while intentionally making everyone think they meant something else that was really a lie. I mean, Clapper has already admitted he lied to Congress, right?

bigiain• 13 years ago

Especially when they're clearly using regular words re-interpreted into jargon to intentionally mislead the people responsible for their oversight.

"Collect" apparently has an intelligence-community meaning that's quite different to the regular dictionary definition - when the NSA says they don't "collect" data, what they seem to mean is that their computer systems intercept and archive that data, but that human analysts haven't (yet) looked at it.

In what other profession would you get away with making up a new definition of a word that's almost 100% opposite to the "regualar" meaning of that word, then using the word with your meaning when talking to the government? "Oh no, I didn't 'steal' that money - in the investment-banking-community, 'steal' means spending stolen money. I haven't spent any of that money yet- it's still sitting in my bank account - so no, I didn't steal any money."

cma• 13 years ago

"So I responded in what I thought was the most truthful, or least untruthful, manner by saying 'no'."

asperous• 13 years ago

The statement that a single analyst can eavesdrop on domestic communications without proper legal authorization is incorrect.

The words italicized are qualifiers- that is they reduce the scope of the statement. It is uncertain that if you removed any one of those qualifiers the statement would still be true.

drivebyacct27• 13 years ago

Right. When you find a way to magically control the bits read from one hard drive and can ensure that same sequence of bits isn't "copied" and written to a different storage medium... without a "second person".... well, you let me know.

I guess with some right group policy settings, a TPM and BitLocker, you could get close maybe. Still going to be challenging to keep me from booting the machine, logging into it and catting that file... somewhere. Give me `wget` and a script and I could transmit data using only GETs.

fragsworth2• 13 years ago

I think they mean that two people must be working together at all times whenever dealing with classified information.

You can't even access your own work computer without another person present.

It works. It's just extremely inefficient.

jimbokun• 13 years ago

Pair sys admining!

Amadou5• 13 years ago

Most systems will not have any sort of external media - no floppy drives, no removable hard disks, no cd burners. USB ports will be filled with epoxy and any peripherals will also be physically secured to their ports. Wherever possible drivers for external media will simply be removed from the OS installation image for those systems.

That will leave a handful of system that do have external media. Those will have extreme access restrictions - at a minimum account restrictions and audit logs that will be regularly correlated with a hand-written log that contains timestamps and signatures of both people. They may even put the system in a room with keycard access that requires two different keycards and associated PINs to be entered before the door opens.

gizmo6862• 13 years ago

The NSA doesn't care at all if you copy the bits from there drives and publish them. What they care about is if you copy the content and publish that. With the right crypto, the bits would be indistinguishable from random data. There are well established crypto systems that requires any n keys to decrypt. Plug in n=2, and you have a crypto enforced 2 person policy.

If you push decryption to the client (where it should be anyway, don't want plain text over the wires), then even with access to the data center, you cannot get the plaintext.

What I don't think pure crypto can get you is a quota on how much an individual can access.

Also, the fact that a single person can bypass whatever alarm systems they have means that if an external adversary gets root, they are undectable.

drivebyacct27• 13 years ago

the implied means of power, the threat of force, rather than by direct military force

Sure, right, that's kinda what I implied with my post. As long as I have access to decrypted bytes in memory and I have access to: my eyeballs + pen + paper, then the jig is up.

The TPM+BitLocker scenario would protect the data on the hard disk and prevent offline attacks and would prevent someone from trying to extract the key from the running OS.

the implied means of power, the threat of force, rather than by direct military force

Ding ding, exactly. That's why I mentioned "Group Policy". At best, you could attempt to restrict user access to the LIVE mounted decrypted data... but at that point you're trusting the client and a dedicated individual would get around it.

You'd almost need this:

Request remotely-stored invididual encrypted file -> Receive it locally -> Decrypt locally.

which would give you a chokepoint to be able to cut off access to the encrypted data, but there are a thousand problems with this scenario as well, just from a technical standpoint.

codeulike• 13 years ago

I am reminded of something someone* said about leaks in 2006:

The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive "secrecy tax") and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption.

Hence in a world where leaking is easy, secretive or unjust systems are nonlinearly hit relative to open, just systems. Since unjust systems, by their nature induce opponents, and in many places barely have the upper hand, mass leaking leaves them exquisitely vulnerable to those who seek to replace them with more open forms of governance.

In other words, in an increasingly digital world, its gets easier and easier for large scale leaks to happen, and although you can take measures to try and stop that, overall those measures will damage your effectiveness even more. Some leaks are 'good' and some are 'bad', but over time, in a leaky world, the overall long term effect should be positive - a move towards more openness.

* its pretty obvious who, but I don't want to derail.

ef42• 13 years ago

"The more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie. This must result in minimization of efficient internal communications mechanisms (an increase in cognitive "secrecy tax") and consequent system-wide cognitive decline resulting in decreased ability to hold onto power as the environment demands adaption."

- Julian Assange, The Nonlinear Effects of Leaks on Unjust Systems of Governance

fragsworth2• 13 years ago

So we as taxpayers:

1. Did not know about this surveillance

2. Would not have voted for it to be put in place

3. Are (for the most part) angry that it happened

4. Must pay extra taxes so they can be sure to keep it secret next time

I've never been more pissed off about my government.

hermannj314• 13 years ago

I'm not mad about it because I pay taxes. Minor children, tax-exempt institutions, those with no income: they all deserve to be free of unjust government surveillance. Conflating the issue with the paying of taxes in a progressive tax system may introduce the rationale that those that pay the most taxes are the most deserving to not be watched.

In fact, some of nation's largest taxpayers (in the black corporations) are actively cooperating in this endeavor, so making this about taxes would seem to argue that the "taxpayer" has already spoken.

tzs• 13 years ago

You are implicitly assuming that there is nothing that the government legitimately needs to keep secret. Can you justify that assumption?

spodek• 13 years ago

North Korea also has a three-person rule for its soldiers at the DMZ to make it harder for any one to defect.

A better solution is to stop making your country one people want to escape from.

Or in the NSA's case, stop violating the Constitution, lying to Congress, etc so people don't feel compelled to blow the whistle.

Is it that hard to follow the Constitution?

smokeyj• 13 years ago

This could be a new freedom index: How many bodies are required to stop the truth from getting out?

thufry• 13 years ago

That may solve the whistle-blower problem, but it doesn't solve the spy problem. There are actual spies, paid in cash, who traffic government secrets, who need to be stopped regardless of your opinion on whistleblowers.

drivebyacct27• 13 years ago

Does "having a second person" even really lend itself to prevent spy-leaks though?

I'm imagining an embedded spy with access to this data wouldn't have to work too hard to circumvent such seemingly honor-based access systems.

cpursley• 13 years ago

"A better solution is to stop making your country one people want to escape from."

Damn right. What an insane situation. My (Soviet) Russian-born wife keeps saying, 'yeah, that's what they did in the USSR'

quesera• 13 years ago

I wonder if NSA really comprehends the breadth of what's going on here. I don't think Snowden was a singularly disgruntled guy who happened to have clearance.

His former coworkers are going to be smart, American, and patriotic too. Some percentage of that class of people will have strong opinions about being complicit in borderline-Constitutional activities. Snowden was the first to come forward, but do you really think there isn't a significant pool of sympathizers still at NSA considering making a similar move?

Requiring cooperation between two analysts does raise the bar somewhat. But I think NSA would be making a mistake to assume that this is an isolated problem, with a tactical solution. I hope that the next guy (or pair) to come forward is as circumspect as Snowden seems to have been. Thank goodness Bradley Manning didn't work at NSA -- that scenario would have real consequences for the world, instead of the noisy internal (and important and necessary) squabbling we'll be doing for the next several months.

harryf• 13 years ago

His former coworkers are going to be smart, American, and patriotic too.

So the NSA needs to offshore that work to China in future

antimagic• 13 years ago

Yeah. The worst of it is the corollary - you need to fire people that are ideologically impure. If people openly start talking about how they consider the Constitution to be an important document that needs to be protected by individual actions, then they can easily find an ally to make up the second person. To make the two person rule effective, you have to eliminate anyone that openly admits that they may very well break the organisation's rules in favour of the Constitution.

That will be the NSA's finest hour - firing people for stating that they support the US Constitution...

mpyne3• 13 years ago

NSA really should have had better internal controls in place for decades, if this leak is anything to go by.

They got lucky, nothing more, that Snowden is a concerned citizen and not an actual spy. No single person should be able to do what Snowden did even if you assume all NSA analysts are 100% comfortable with the mission.

In nuclear weapons two-person concept is a huge, huge, huge deal. NSA's stuff might not be to the exact same level of seriousness but at the same time "TOP SECRET" implies grave risk to national security if leaked and their internal controls should have been equal to the risk implied by that.

jpatokal• 13 years ago

Not really -- there are 1.4 million people in the US with "TOP SECRET" clearance, which means that most stuff flagged as such is far from it.

http://au.businessinsider.com/edward-snowden-top-secret-clea...

Daniel_Newby2• 13 years ago

Indeed. They need to come up with some sort of criteria for evaluating trusted computer systems.

a3n4• 13 years ago

"They got lucky, nothing more, that Snowden is a concerned citizen and not an actual spy."

Actually Snowden may have been the NSA's lucky break. Doesn't it seem likely that there are poeple selling secrets to enemies within NSA/Booz Hamilton? This forces them to deal with a system that probably makes that relatively easy.

Cherish your bugs.

SideburnsOfDoom• 13 years ago

The East German Stazi were similar:

"the fierce surveillance within the Stasi of its own men, of how in a case ... there might have be a dozen agents: everything was checked and cross-checked." http://www.guardian.co.uk/books/2007/may/05/featuresreviews....

donrhummy• 13 years ago

I'm surprised they weren't already using a threshold-scheme. (Similar to this: http://en.wikipedia.org/wiki/Threshold_cryptosystem )

fragmede• 13 years ago

Political implications aside, I'm glad to hear about the technical methods for implementing this.

I've heard of high-security facilities prohibiting cameras, of any sort, so no cellphone to take pictures of the screen, either.

anaptdemise• 13 years ago

I seem to remember watching a documentary of the Berlin wall in which soldiers in the guard towers were not in casual communication with soldiers walking the wall/fenced area. None of them were there to keep people out, but in. Watchers monitoring watchers... Wish I could remember which documentary it was.

mullingitover• 13 years ago

I believe this was the kind of thing that Wikileaks has been shooting for all along--make the keeping of dirty secrets so cumbersome that it becomes infeasible to keep them. This chicken has already flown the coop: the next leak will likely come from elsewhere, and again the government will be forced to scramble and plug hole that already leaked.

a3n4• 13 years ago

Pretty soon NSA employees won't be allowed to bring small pocket knives and shampoo into the office.

sireat• 13 years ago

For some reason I am reminded of Feds in Snow Crash. Unfortunately, in real life, we can not opt out of states so easily.

vidarh2• 13 years ago

Full body cavity scans on every entry and exit... A micro-sd card, USB plug, and necessary bits to connect them are easily small enough to be swallowed, hidden under your tongue, stuck up your anus or hidden in any number of ways.. Clearly they need to be regularly strip-searched and x-rayed.

jrochkind12• 13 years ago

was one of close to a thousand systems administrator

Huh, that gives some idea as to the operational scale of NSA systems.

It's ironic how much we're learning about how the secretive NSA does things.... from public releases by the NSA themselves, in their attempts at PR damage control.

kragen2• 13 years ago

This may or may not be true.

nostromo• 13 years ago

The saddest part of the story is that there are two quotes, one from a democrat and one from a republican, and both are falling all over themselves in a rush to brand a whistleblower as a traitor.

The second saddest part of the story is that the person responsible for securing the biggest DWH of all time freely admits that they have no protection against rogue sysadmins, most of whom don't even work for the NSA.

gulfie• 13 years ago

Those are the senators that have probably said something to someone over a phone that ... that just maybe might get them into trouble if it ever leaked out.

cavilling_elite3• 13 years ago

The "second saddest part" makes me realize why all of the government agencies get C's or less in the NIST tests for securing systems. When the NSA can't even employ their own in-house sysadmins, there is no real hope for defense against political espionage.

If Snowden was the first to leak information, who was the first to sell it? The way Snowden describes the access seems like a joke.

hobs• 13 years ago

GREAT POINT. If someone could leak this much information as a sysadmin and do it effectively, how could it have not been sold? The value of such information would be astronomical to other spy agencies who would be opposed to us.

scarmig• 13 years ago

One has to also wonder: how many have sold it before Snowden leaked it? I have a hard time guessing the ratio of people willing to silently sell information versus loud do-gooders, but I have a strong suspicion it is greater than one. And of course one person can sell multiple times...

Amadou5• 13 years ago

Frankly, who Snowden's employer was on paper is irrelevant. There is nothing about being a government employee that makes one more loyal or trustworthy or any other characteristic. Everybody goes through the same vetting process by the same government agency to receive a clearance.

If anything, a contractor is going to have additional vetting. As an employer, the federal government is bound by constitutional restrictions that private employers are not. For example suspicion-less drug testing is not a requirement for a clearance (affirmation that you haven't used illegal drugs is a requirement, but actual testing is not). However most private employers are all gung-ho on the drug testing front and do force employees to be tested to whatever level their local state laws permit (there is significant variance by state as to what a private employer can require).

dragonwriter4• 13 years ago

There is nothing about being a government employee that makes one more loyal or trustworthy or any other characteristic.

A government employee might be getting paid by a third party whose interest diverge from the government's.

A government contractor is, by definition, getting paid by a third party whose interest diverge from the government's.

charonn0• 13 years ago

I found the quotes appalling, though I was not surprised that one of them was from Michelle Bachmann.

cpeterso• 13 years ago

“We have to learn from these mistakes when they occur,” Representative Charlies Ruppersberger said to Alexander in the hearing. “What system are you or the director of national intelligence administration putting into place to make sure that if another person were to turn against his or her country we would have an alarm system that would not put us in this position?”

So the lesson is not how to prevent the NSA's domestic spying, but how to prevent getting caught?

diminoten• 13 years ago

I dunno, from a purely tech standpoint, it's a classic problem isn't it? How do you stop your sysadmin from fleeing with all of your company's data?

I think the current solution is to just trust that your sysadmin's career would be over if he/she took your data. Kind of doesn't work as well for stuff like this, though, considering the person who'd steal your data probably at this point doesn't care.

corin_• 13 years ago

OK so here's the question: who thinks that everything the NSA does should be public knowledge - not just what they do, but everything they have, all their data, everything.

I'm sure some people do, but would imagine most don't. Most want a public overview of what they are doing and what rights they have, but understand that specifics/data need to stay secret.

For this to be the case, surely they do need to make sure security is as tight as possible. But on the flip side, if they were able to 100% prevent all leaks, it would mean that nothing like this could happen again, i.e. the kind of leaks that we want to see. So where should the line be drawn?

rz2k• 13 years ago

... “When one of those persons misuses their authority it’s a huge problem.”

Since people working in groups never abuse their authority, this sounds like a foolproof plan.

joshguthrie• 13 years ago

I guess I shouldn't have expected less than badmouthing from the cynical HN crowd!

Why is it that everyone chooses to omit the most important thing about this new rule? It was designed especially to make sure the next Edward Snowden would have an accomplice when taking vac...fleeing to another country and would feel less homesick thanks to the presence of a fellow motherland-er.

I for one, welcome the attention and kindness of our new NSA overlords.

PS: Dear NSA agent reading this, I lost access to my old Yahoo! Mail account where I still have love letters sent by my ex-girlfriend and goth poetry I wrote when I was 18. Think you could help me? Thanks for your help! XOXO

astangl• 13 years ago

How well will the "two-person" rule work, once the second person starts to treat it like a rubber-stamp process? How do you prevent that from happening without introducing big inefficiencies?

Daniel_Newby2• 13 years ago

It will work pretty damn well when the NSA is constantly planting fake spies and the death penalty is in play.

corford4• 13 years ago

From the article: Representative Michelle Bachmann emphasized that the NSA should answer “how a traitor could do something like this to the American people,”

After watching the USA Today interview with Binney, Drake, Weibe and Radack (http://www.usatoday.com/story/news/politics/2013/06/16/snowd...), Bachmann's demand and the language she used make me incandescent with rage.

I cannot get over the ignorance of the woman to be able to come out with something like that in good faith.

dragonwriter4• 13 years ago

I simply cannot understand the ignorance of the woman to be able to say something like that in good faith.

What makes you think she said it in good faith?

corford4• 13 years ago

Heh yeah. I guess I'm desperately clutching to the (futile?) belief that US congress is primarily stuffed with politicians of the dangerously incompetent and naive kind rather than the evil lizard people kind. People like Bachmann make me wonder though.

j_baker• 13 years ago

I'm simply dumbfounded by this. Why is nobody at the top taking any steps to do anything about the fact that Snowden had almost unhindered access to spy on whoever he wanted? That seems like a far more concerning security hole to me.

btbuildem• 13 years ago

It's a feature not a bug, apparently.

tkiley• 13 years ago

If they are operating according to the laws of the land, they have "nothing to hide" from Edward Snowden and his ilk. This move looks pretty suspicious to me...

;-)

bobwaycott• 13 years ago

The most disturbing comment from the article:

* "We have to learn from these mistakes when they occur,” Representative Charlies Ruppersberger said to Alexander in the hearing. “What system are you or the director of national intelligence administration putting into place to make sure that if another person were to turn against his or her country we would have an alarm system that would not put us in this position?"*

So now the good Representative Ruppersberger is taking part in the automatic branding of Mr. Snowden as one who has turned against his country. For whistleblowing.

This is the wrong path.

a3n4• 13 years ago

But it's the easier path. It's hard to fix the problems they have. It's easy to throw someone under the bus, dust your hands off and declare "job well done."

glenra• 13 years ago

I though this question was interesting:

“What system are you or the director of national intelligence administration putting into place to make sure that if another person were to turn against his or her country we would have an alarm system that would not put us in this position?”

The thing is, Snowden didn't turn against his country. Snowden turned towards his country...and against the schnooks who were undermining it.

There's a balance here. There is danger in making it too hard for somebody with a conscience to use it to make things better. The fact that it took this long for the truth to get out suggests to me that the controls they already have in place (along with whatever social pressures surround them) might be fine or even a little too strict.

craftsman• 13 years ago

I once worked at a company which had a form of the two-person rule for production changes. The company's change control team thought that by requiring a second person on the development team to 'certify' that the change was 'good', they could cut down on some vaguely imagined problems.

What really happened:

Bob (via IM): Hey Mary, here's a change request link, can you hit 'approve' real quick? Mary: Done

I bet that some slightly more sophisticated version of this will happen with this new 'two-person' rule.

marcamillion• 13 years ago

Don't they realize that no matter what they try, they can't stop leaks.

Just like you can't get 100% security.

HaloZero• 13 years ago

Am I the only one who thinks the NSA should be doing something to ensure that this doesn't happen again, as in precautions against the gathering of data by an individual?

While Snowden did have proper justifications and reasons for the exposure, the fact that he was able to is still not a good thing for the NSA isn't it? Someone else who might not have America's interest could do the same thing theoretically which is bad.

NSA Implementing 'Two-Person' Rule To Stop The Next Edward Snowden

Related Stories