recommended reading

NSA Networks Might Have Been Missing Anti-Leak Technology

Andrea Danti/

This story has been updated with a statement from NSA. 

A National Security Agency information security official who left the agency in the summer of 2012, said that at that time, there was no anti-leak technology on networks to help prevent the disclosure of sensitive information. Such technology alerts managers to anomalies in how insiders are accessing protected data. 

This spring, Edward Snowden, a former NSA contractor, could have taken advantage of such a loophole. He allegedly downloaded onto a thumb drive top secret files detailing the agency's controversial surveillance of millions of Americans' call records and foreigners' online communications. Snowden, since being fired from his job as a system administrator for NSA contractor Booz Allen Hamilton, is reportedly in Moscow seeking asylum in South America while U.S. officials seek his extradition on charges of espionage. 

Defense Department officials have said a Host Based Security System, which, among other things, monitors removable data devices such as CDs and thumb drives, was activated departmentwide to track unauthorized network activities. NSA is a Defense agency. 

"When I left, HBSS was not installed at NSA," the former cybersecurity official said, adding the agency doesn’t always follow Pentagon advice.

The tool was rolled out at Defense following security breaches allegedly committed by Pfc. Bradley Manning, who sent anti-secrets website WikiLeaks a trove of digital materials revealing sensitive combat actions in the Middle East. 

In the wake of the Snowden incident, NSA Director Gen. Keith Alexander said the agency will employ a “two-man rule” to reduce the risk that system administrators will raid NSA computers. 

The former NSA official cautioned the buddy system arrangement might be too tedious for technical specialists performing fast-paced work.

Even Defense's system might not be able to halt a rogue employee in real-time because it generates a lot of false alarms that could desensitize supervisors to real trouble, the former NSA official said. But at least NSA would have been able to review audit logs of network activity, using pattern-matching technology, to spot inappropriate user actions, the official added.

There is no technological solution to prevent someone from leaving an NSA facility with removable media in hand. "Once it’s extracted there's not much you can do about that," the former official said. The best safeguard would be locking down the content at the source. "You want to make sure that you have access controls on the original data itself," the person said. "Suppose it was court-related data, there's only very few people who need to look at that data."

The former official said background checks and other human decision-making cannot avert national security leaks. "You have to make sure technical controls are in place,” the person said.

NSA spokeswoman Judith Emmel said in an email, "As Gen. Alexander has directed, NSA is working around the clock to investigate, analyze and address the issues and their root causes -- both in the immediate [future] and over the longer term.”

(Image via Andrea Danti/

Threatwatch Alert

Network intrusion / Spear-phishing

Researchers: Bank-Targeting Malware Sales Rise in Dark Web Markets

See threatwatch report


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

  • Toward A More Innovative Government

    This research study aims to understand how state and local leaders regard their agency’s innovation efforts and what they are doing to overcome the challenges they face in successfully implementing these efforts.

  • From Volume to Value: UK’s NHS Digital Provides U.S. Healthcare Agencies A Roadmap For Value-Based Payment Models

    The U.S. healthcare industry is rapidly moving away from traditional fee-for-service models and towards value-based purchasing that reimburses physicians for quality of care in place of frequency of care.

  • GBC Flash Poll: Is Your Agency Safe?

    Federal leaders weigh in on the state of information security


When you download a report, your information may be shared with the underwriters of that document.