From reading a DOE website, it looks like the sigma clearance is the one that relates to weapons, whereas Q maybe is less specific and can include energy production.
I knew some number theorists at the NSA who claimed have Q clearance (long before QAnon was a thing). As far as I know, they know nothing about nukes. Have I been punked, or is the NSA a branch of the DoD?
This is pure speculation: if someone worked on some kind of communication involving nuclear missiles, they might work for the NSA and have Q. But otherwise I can’t think of a reason they would. That said, NSA is a world almost wholly unknown to me
What I know: clearance is compartmentalized. The NSA's mandate is both to break foreign crypto, and protect sensitive communication. That includes, possibly, the means to break domestic communication about, well, anything, including nukes. The laws and policies regarding this are, themselves, secret. There's even a secret court. The existence of these secret courts and secret laws has recently been affirmed as legitimate by the supreme court.
So, no shit you're speculating, and I very well may have been lied to by the person attempting to recruit me to the NSA. I didn't want to live in secrecy; soon thereafter, Thomas Drake's reports confirmed my suspicion that the NSA wasn't as white-hat as I'd been told.
You need Q for certain facilities as well, SWIM had one and it was just to work in the building, and there wasn't anything going on there of particular interest
Just because you had no legitimate access to anything interesting doesn’t mean there was nothing interesting you could have accidentally or nefariously accessed.
I had a clearance doing tech support, but never even saw actual classified materials. But because as IT support we also had to support SCIF facilities, high-ranking officials with potentially sloppy OpSec, etc we obviously still needed clearances.
So, a lot of people. This backs up another poster’s assertion that Q clearance is required for certain jobs, even if you don’t handle any information that requires it. ~100,000 people with some secrets is probably too many people to actually keep said secrets secret.
Note that Sigmas further control various types of information. The number of people with something like Sigma 20 (very sensitive data regarding certain improvised nuclear explosives) is a small subset of those with a Q clearance.
And of course, our friend Need To Know is always in play.
I would imagine that how many people have actual access to nuclear information is more closely guarded.
Most of these people wouldn't have any actual access, they just have the clearance that would allow them to have access if they are in a role that requires access.
A lot of people at the national labs have Q clearances, even if they never do nuclear stuff. As the article somewhat mentions, it's roughly 'Q=TS+nukes'. So if you need to do any TS stuff at a national lab, you're going to get a Q clearance.
It's very rare that if you meet TS requirements you're not getting the Q (if you're placed in a position where it's needed as more than likely you are already SCI cleared). In fact if you are denied for Q it likely means you're losing your TS too. There are exceptions but I would argue they're not the norm.
Either way, we have propensity to over classify things in the government and that's a whole other argument.
I recall the two biggest stories about foreign spies in these labs:
1. Chinese blamed for stealing Los Alamos secret by stashing hard drives behind a copy machine and grabbing them later.
2. Chinese engineer at JPL worked there for decades and was thought to be a nice family in Pasadina - but lived in a really super spartan house and the wife was the engineer's handler and their kids were the mules to haul data back to ccp
3. China's trickle hack on Lockheed by phishing employees who had attended defense conferences
4. China hacking Lockheed providers in Taiwan with an air gap and sneaker-net to gain access to Lockheed laptops via USB exploits (this was one of the factors, IIRC why epoxy in USB ports was common) -- ((But if you ever had any SGI O2 machines -- there was an additional port (serial I think - I don't think they were USB) but this 'option' was several thousand more $ -- but it was on every machine and all you had to do was punch out the plastic cover from the case)
5. Israel + USA hacking Iran via STUXNET in the same method with air-gaps etc.
6. The guy who worked at oak ridge, took on a Russian Mail Order Bride and got her a job in oak ridge (accounting I think, I can't recall) -- and it turned out she was a Russian handler, but they denied it -- but everyone knew that every single person from the USG who went to Russia was assigned a female handler, and these handlers were highly trained, and they had several levels of handlers above them to ensure non-defection chain-of-custody-of-intel.
---
I had a few more specific to nukes - but I got distracted - Ill update if I recall the others.
Some of the above have REALLY good documentaries on them. Some of them are known by fewer people - but they are not secret breaches... they got memory-holed.
If you're not using Wen Ho Lee as a counterexample this is misinformation.
I was watching this at the time and... yeah, ex Q cleared at the time, and NYT revealed some of its underlying profit driven sleazy motivations with that hack job.
The others could be legit, I have no idea. But be careful before the evidence gets brought to trial and a guilty verdict is obtained.
Snowden showed and I can confirm, from decades earlier, there's a lot of workarounds going on daily just to get shit done. Some were absurd.
I never did any TS stuff with my Q clearance. Nor was I on track to do so. I got the impression that it was just another level of interview screening, because they could. Frankly though the emergent social environment gave me the creeps, so I quit.
Bay Area lab, lot of weirdos (who I liked a lot) living in that creepy scene. Forces of control over a cute zoo of nerds.
Worked at LLNL Loong time ago. I loved the weirdos there. Any random day you could sit next to someone during lunch and get a masters level course on flywheels or vacuum pumps.
I think you're being too literal. Using hyperbole here is the equivalent of saying "their security was so bad they might as well have just handed over the information".
I think it’s fair to say that there are offensive cyber intelligence operations that are never detected or made public. It’s more than likely there are other foreign intelligence agencies that have breached similar databases at other agencies. It’s also likely that allied agencies share intelligence between themselves, and also suffer hacks. I would reason that any nation vying for superpower status has a good amount of data on the majority of folks who touch national security in every country.
AFAIK, the number of people with TS//SCI is not actually classified. It's just hard to get a complete headcount because of how broad the designation is.
As of 2017, approximately 2.8 million people held TS[1]. A sizable percentage of those people are also probably TS//SCI.
Edit: Uncited, from Wikipedia:
> In general, military personnel and civilian employees (government and contractor) do not publish the individual compartments for which they are cleared. While this information is not classified, specific compartment listings may reveal sensitive information when correlated with an individual's résumé. Therefore, it is sufficient to declare that a candidate possesses a TS/SCI clearance with a polygraph.
The absence of public information doesn’t mean that something is classified. It just means that nobody’s requested it. Again, to the best of my knowledge, the number of people who hold TS//SCI isn’t itself classified. Feel free to submit a FOIA and refute that.
Full Scope refers to a type of polygraph examination which someone might be asked to undergo as part of the investigation process before getting a security clearance. At one point, you could either get a counter-intelligence polygraph examination, where you were asked questions basically to determine if you were a foreign agent, or approached to work on behalf of a foreign agent, and that would take half a day, or you could be given a "full scope" polygraph examine, which might take a full day, and would ask a much larger invasive set of questions about your lifestyle. For example, a decade or two ago, you might be asked questions about your sexual practices and/or identity lest that be used as blackmail leverage by a foreign agent. (For example, if you say, were into golden showers, and were trying to keep that a secret, might Russia be able to use the threat of making a video tape of that practice to get you to betray your country?)
Access to some security comparments ("Sensitive Compartmented Information") might require both a need to know, and either a Counter-Intelligence or Full Scope polygraph examination. If you have a current (non-expired) TS/CI Poly or TS/FS Poly investigation, could be quite valuable to a defense contractor, because it can take a while (potentially months or years) and cost $$$ for you to get that investigation, which combined with the need to know, would be necessary to get you access to certain classified compartments which might be necessary for you to work on a particular project. Otherwise, you might have the necessary computer skills, but without having the requisite security clearance investigation having been done on you, the defense contractor might have to hire you and have you work on non-classified aspect of the projects for months and months (or if you are a new college grad, maybe even twiddling your fingers) until the security clearance investigation had been completed.
I think the notion of "lie detector" has been discredited. Someone who wants to learn to pass a polygraph can probably do so. Screening applicants for vulnerability doesn't have to be a perfect process as it's part of a larger security system.
Ironically, a layperson probably would give away their secrets easily because of the anxiety of the situation, while someone who might actually be an offensive threat is more likely to be able to beat a polygraph.
Realistically, they are probably very effective at verifying whether normal people have secrets that could be used for blackmail, as you say, because of the psychology, even if the machine isn't actually doing anything.
Anecdotally, I've heard of security interviews (for government intelligence, I can't give context) where the interviewer just says "i'll know if you lie". For the average person this is enough to make them flustered if asked an awkward question.
I think that’s the goal: the polygraph isn’t supposed to catch a pathological liar or mole. It’s supposed to fluster you into telling the truth, even the embarrassing truth, to ensure that you can’t be blackmailed or extorted. I’ve heard my fair share of funny(?) stories about polygraph admissions that basically ended in the interviewer shrugging and saying “well, at least you didn’t hide it.”
I've heard stories about the polygraphs that basically boil down to: we don't care if you smoke weed. we DO care that you tell us and don't lie about it.
I heard about one guy who couldn’t pass the poly no matter how many times he took it. He chalked it up to Catholic guilt. He ended up going to work for a different company doing rocket stuff (I think the ULA) cause he could use his clearance but they didn’t require polys. He might even still have access to JWICS in his new job
WASHINGTON (Reuters) - A White House whistleblower has said the Trump administration overruled security experts to give questionable security clearances to more than two dozen people, including the president’s daughter Ivanka and son-in-law Jared Kushner.
Yes, they’ve been discredited as a binary, true or false, lie detector. However a skilled investigator can still use polygraphs as one tool in a toolbox to hone in on particular areas. They can then either have the subject contradict themselves or find areas to further investigate (e.g. asking the neighbors what sorts of people the subject has over.)
They still ask about sexual preferences, but really it's more about anything not publicly known that could be embarrassing. No one cared that I'm bi and not out to my mom but they wanted to know that I would go to my FSO and let that get out before I passed any sensitive intel to a foreign adversary who might try to blackmail me.
And basically everyone with the SCI designation could get a call to get a poly anytime, but I've never had one and know people who've had their clearances for years without getting that call (and I know a couple people who had them before the government finished that person's background investigation, so go figure). Some agencies care quite a bit, others not at all.
Isn't "Q" only a general top clearance and not really revealing how many people are privy to important secret information? I understood that Q indicates someone could be given access to certain information from a risk point of view, and only with some further project-specific reason would they actually have access to actual secrets.
A Q clearance could mean you are privy to absolutely nothing. The janitors cleaning the buildings in the secure part of LANL all have Q clearances because they might, might, be exposed to classified information. Needless to say, just because they might poke their nose in the wrong office, doesn't mean they will. The less you know, the less the Lab wants to track your whereabouts after hours.
No, as the article tries to make clear, it is for handling of nuclear weapons-related information only. And yeah, people get it because they need to work in a lab or otherwise be proximate to the work, but aren't working directly on it themselves.
It is definitely not for handling nuclear weapons-related information only. It's as generic as a normal TS in that agency and is even given temporarily to people coming in from outside agencies with a TS/Poly for meetings.
The easiest way to understand is to picture if clearances didn't exist. If you had a requirement for certain material, someone would have to decide if you were safe, perhaps do background checks, get someone to vouch for you, etc.
Clearances just standardize that, so you can trust that it's been performed within X years. You still don't share material without a requirement, you've just outsourced the other half.
Former national lab engineer here. For access to any of the classified buildings, you must have a Q clearance or be escorted by someone with a Q clearance. This means all of facility staff are required to be cleared as well (janitorial, maintenance, etc). Just because one has a Q clearance does not mean you are provided any classified information.
We will never know for sure, but well researched and supported theories about who is behind the Q persona indicate that none of the people involved have ever seen the inside of a secure facility.
That's what I read too. "Q" seems to want to imply that he's some super-privileged insider. But apparently a Q clearance is not all it's cracked up to be.
Remember that the best lies also have a kernel of truth in them. You don't need to have a Q clearance to say you have one on 4chan, 8chan, 8kun (etc). How would anyone validate your Q clearance? Instead you just post something plausible, but just out of the reach of validation.
You could tell that Q Anon was fake from the very first post, because they said Q was the "highest clearance," a statement that is doubly incorrect. Q is an access, not a clearance. Confidential, Secret, and Top Secret are the only clearances—people with Q must have a Top Secret clearance. And, Q doesn't provide you access to higher level information about global politics than Top Secret, it provides you access to information about nuclear weapon design. None of the things Q Anon purported to have insight into were at all related to the actual information controlled by the Q access.
> Confidential, Secret, and Top Secret are the only clearances
Not necessarily. Maybe in DoD land, but there's also a different system (uses similar terminology) for the State Department, and Department of Education (and some others) also has a thing called "Public Trust Clearance" and they involve different background checks (which aren't transferable). But the DoD clearance is the one that takes much longer to complete.
That’s what most people who have never been granted or interviewed for clearances don’t quite get. You could technically have the same level, but not the same access. It’s compartmentalized and for the exact reason as to prevent a single person from being able to leak the grand picture.
Though someone has to organize it so I guess it gets blurrier at much higher levels but that’s not the level we talk about with most dumb conspiracy theories/Qanon specifically
I think the common misconception is that a security clearance gives you access to things. The reality is that a specific role / need to know gives you access to things if you have the clearance, not the other way around.
If you clear millions of people, that sounds unsafe to the general public, but it isn't really because the clearance is only a confirmation that nothing is wrong in your background. It doesn't give you any access.
Exactly, most programs require specific compartmented information and additional read in. I've only ever seen people with vanilla clearances working operational positions to manage facilities, etc.
LOL from reading the New York Times reporting on the DoD’s internal UAP (UFO) reports last summer me and a guy I worked with guessed which compartment it fell under. We went to our FSO and asked for access to that compartment and he was like “why do you need that?”
Us: “UFOs!”
Him: “Oh, you mean FUOU? That goes by CUI these days.”
Us: “No, UFOs like Aliens!”
Him: “GET THE HELL OUT OF MY OFFICE!”
So yeah, even with TS/SCI I couldn’t couldn’t get access to aliens :|
FOUO, for official use only. That’s non-secret but not appropriate for general release information (for some reason). CUI is the updated version of that level of classification.
FOUO - A doctors patient list. That isn’t the business of the public and should not be released. That data does not contain PII, patient health data, and is not protected as a matter of security but it is still protected data.
Classified - Data that is restricted from public release. This is lowest level of protection and is intentionally vague.
Secret - Information that if disclosed can be used to harm people or disrupt government operations by adversaries. This includes information like convoy travel schedules and communications outages. Secret data is typically really boring office information in otherwise more exciting work.
Top Secret - This information, if disclosed, will likely result in embarrassment to the extent that national security or diplomatic relations suffer or that the intentional imminent danger of death or bodily harm occurs to people.
I get what you're saying but a doctor's patient list contains PII and patient health data. The fact of a patient seeing a certain doctor, especially a specialist, reveals some private health information of a patient.
It's also a common misconception that classified information is super-special-whiz-bang-James-Bond information. A lot of it is really dense technical stuff that wouldn't be of interest to outsiders unless they were foreign agents looking to steal, say, tolerances for parts that go into a piece of military equipment.
Also, if you only protected your most important secrets, it would be pretty easy for an adversary to spot where those are and who might have access to them. By having a very wide scope of what’s classified, the really juicy stuff is a needle in a mundane haystack.
I had a secret clearance in the Army 25 years ago, and the sexiest secret I ever learned was a number...which was the obvious product (like literally x*y) of two unclassified numbers.
If x and y were primes then your secret was probably quite valuable at that time. 25 years ago is about the right time for RSA encryption to still be state of the art at the NSA and whatnot. The reason this is valuable is that you can multiply the two numbers quickly, but figuring out the two numbers knowing only the product is extremely hard (mathematically/computationally). When x and y are large primes, then the division takes a long time (decades depending on the size of the number).
Is it possible that you actually learned some important private cryptographic key? If so, that number might have been sexy but you just didn’t actually have visibility into a bigger picture?
> Is it possible that you actually learned some important private cryptographic key
No, it was more like "this chainsaw cuts through 3 inches of wood per second and it falls apart in half a minute, so the amount of wood you can cut with it is [REDACTED]"
>> Is it possible that you actually learned some important private cryptographic key
No, it was more like "this chainsaw cuts through 3 inches of wood per second and it falls apart in half a minute, so the amount of wood you can cut with it is [REDACTED]"
That actually sounds like a pretty secure password.
Sure, I guess you could say that a 500-digit number has 500 unclassified components. It makes sense that each of the digits have been written somewhere publicly.
But where would the x or y have ever been written publicly?
it depends. theres not a lot of granularity in the classification system and the government is loathe to declassify old stuff. thats why s\c\i is the best clearance marking i know of and basically means "dont tell anyone even if they have a clearance"
a lot of nuclear navy info is decades old and shares the same classification level of new, novel tech. suffice it to say submarines are doing cool things and i certainly dont know the half of it.
I had a secret clearance when working for a government contractor at a civil agency. I don't remember anything particularly sensitive ever coming to my attention. Secret clearances are not hard to come by, or anyway were not back then.
They definitely taught us secrets. They had a faraday cage in one of the armored vehicle garages just for that purpose. I was just agreeing with the parent that the secrets were all totally random and mundane. Like if you take a two month auto repair course and when it comes time to set the gap on some spark plugs they herd you into the faraday cage to tell you what setting to use.
I had a secret clearance, and it was used for setting up an application to print pages with a classified banner. Once that page was printed, it was technically classified material. As you know; generation, and possession, and destruction of that material (even if an otherwise blank sheet of paper) - is controlled and documented.
In IT projects, most of us with any kind of clearance NEVER see anything controlled. But the clearance is needed in case we ever need to see controlled information, in order to write code, debug it, operate it, or train others to use the system.
Though some may eventually end up on a system or program whose very existence is classified. And that fact alone, is often not very special, and may be the only thing they ever "know" that's controlled.
Also if you are writing a document, it's much easier to just give it a high classification to be on the safe side than try and figure out what the lowest classification it could have is. And as everybody you are working who will need to read it will have clearance anyway, it won't make it any harder for those people.
>If you clear millions of people, that sounds unsafe to the general public
It sounds unsafe once all the information collected on those millions of people is placed in a central location and then hacked by or leaked to a nation-state level adversary.
If you said that 99% of them don't actually have power or access, it could be true, but irrelevant if an adversary has essentially 100% and unlimited resources to review them and double check the work.
>the clearance is only a confirmation that nothing is wrong in your background
In theory. The security clearance investigators are not perfect, and moreover, it's been publicly reported that sometimes contractors have falsified records showing they performed investigations. Statistically, X% are going to be flawed.
If an adversary has ~100% of the records, then think what they can do by reviewing them. Compromising someone doesn't require an earthshattering discovery because the cardinal sin is failure to disclose.
Let's say, for example, a person smoked pot a few times. From what I've read, that's generally not a big deal as long as you aren't doing it currently and don't lie about your history.
(The DOE rule seems to be that if you haven't used illegal drugs for two years, then they're not disqualifying per se, depending on a holistic look at a person)
But if an adversary has the entire investigation and every other piece of information that the federal government has on every employee, and they can determine that a given person did in fact conceal anything, then it is leverage to compromise them. Do X or you will be exposed as having lied. Or even "do X or you will be framed as having lied". It could be just enough to get someone to perform some action that further compromises them, and so on.
The more people this is done to, the more it snowballs. They could say "this higher up person works for us, so if you don't cooperate they will help us frame you for X". And it could be true, so how can a person verify?
If they have everyone's investigation, then all of the people who do have access to important things are at risk, and anyone who is truly spotless cannot be sure who is compromised.
Ancillary information like fingerprints makes it even worse, as all covert agents anywhere can in principle be detected and eliminated. This type of apocalypse being quiet, an absence of reporting on it wouldn't be evidence against.
I deduce that the whole scenario likely happened starting several years ago, based on public information, summarized at:
I am not making a categorical statement that seeking a cleared federal position is a mistake, but consider the gravity of the decision to trust the system if you do.
I linked to the page on the OPM breach. The reason I wrote "or leaked" is because there is no confirmation of who got it or who they might have given it to.
If people are saying it was hacked by country X, it might be strategic to share it with a couple other countries and let them cause chaos. Then, with clean hands, make speeches tut-tutting about the degeneracy of American culture and democracy.
Trying to orchestrate anything, by actually controlling the US government has a lot of potential downside, and what really is the strategic goal?
Presumably all the countries on the list that the US doesn't like want one simple thing - to be treated (as countries) equally to US allies. It's not necessary to make the US do anything, just to make us incapable of doing anything and unable to be trusted by allies. And that's inherently much easier than control. Not only that, but it doesn't require trust and cooperation among themselves to an unrealistic degree.
I was in a internal software tools department at a large company that did some classified work. Because I might need to interact with departments doing classified work I had to apply for Top Secret classification. This was required just in case I might have to get into those areas of the company to teach them how to use our in-house compiler.
(I didn't finish the process of obtaining the classification because of my desire to return to grad school in a different city. I never touched or even saw a classified document despite having Secret clearance already.)
Interesting. I worked for a company doing some classified defense contracting (as an intern). I didn't need any clearance and the only limitation was that anyone without clearance needed an escort to enter the lab. Although really it just boiled down to "see if someone has opened it for the day yet, if not go ask one to"
(And in reality I didn't even need that because several people kept their lab key in plain sight on their desk in their open office 24/7...)
>> Just because one has a Q clearance does not mean you are provided any classified information.
Exactly.
"Need to know basis." is the key phrase here.
The clearance is just the tag that gets you in the door. If you do not have a specific need to access the information to do your specific job, you do not have any right to access it.
AFAIK, deliberately taking steps to access info beyond your need to know -- even if it is within your clearance level -- is grounds for disciplinary action or prosecution.
So the TS/Q-cleared janitor, parts contractor, or engineer from the other project who gets found browsing in TS/Q file cabinet is waaay out of line,and likely in big trouble.
I was in service during the the start of Wikileaks. We got talks about how going on that site and viewing classified information that is against the UCMJ. It did not matter that the information was now public.
One of the unfortunate things that goes along with this, from my experience, is that those area can be absolutely filthy. There was no janitorial staff for the cube farm I was briefly in. Everything had a layer of old dust and grime on it, and we wiped everything with wet wipes. Men In Black it was not.
Somewhat related, a physicist friend of mine had diplomatic immunity while working at CERN, for no other reason than the fact that the LHC sits on the border between France and Switzerland, and most of the usual diplomatic privileges become pretty important when you’re potentially crossing the border several times a day, potentially importing and exporting expensive equipment.
My father in law was a radio engineer (retired) that had a job installing equipment in a nuclear power plant. He had to go all over the facility for weeks. Based on the article, I would think his clearance would have been S, but the author seems to think S has been discontinued. I’ll have to ask him to see if he remembers when they come over for Thanksgiving.
This isn't a meaningful question IMO. TS, S, polygraph level and SCI/SAP are really the only thing on your employee record with uncle Sam. There is no such thing as "above top secret"
Q clearance is anyone with a CNWDI modifier, so that's secret and top secret.
If folks are curious about "Q clearances" (more appropriately called Q access authorization) I suggest you take a look at this DOE website on departmental security [1]. It will clear up some of the close to correct information floating around in this thread.
Note, one of the very unusual things about a Q is access control for both information AND physical material.
<<
Q: Back up a minute! You just mentioned a "Q" access authorization. What is that and how does it relate to the Top Secret, Secret, and Confidential clearance terminology I'm familiar with?
A: Top Secret, Secret, and Confidential security clearances refer back to the level of National Security Information to which an individual may have access. Because DOE is granting access to Restricted Data and special nuclear material, it uses different terminology. Generally speaking, there are two types of access authorizations, the L and the Q. The L access authorization corresponds to the background investigation and administrative determination similar to what is completed by other agencies for Confidential and Secret National Security Information access clearances and the Q access authorization corresponds to the background investigation and administrative determination similar to what is completed by other agencies for a Top Secret National Security Information access clearance. In addition, because RD information is more sensitive than NSI information, access to Secret Restricted Data requires a Q access authorization.
135 comments
[ 4.0 ms ] story [ 191 ms ] threadSo, no shit you're speculating, and I very well may have been lied to by the person attempting to recruit me to the NSA. I didn't want to live in secrecy; soon thereafter, Thomas Drake's reports confirmed my suspicion that the NSA wasn't as white-hat as I'd been told.
I had a clearance doing tech support, but never even saw actual classified materials. But because as IT support we also had to support SCIF facilities, high-ranking officials with potentially sloppy OpSec, etc we obviously still needed clearances.
Exactly the thing I was thinking after reading just the title. Glad to see he got a response and published it here!
Site is down now, but:
And of course, our friend Need To Know is always in play.
Most of these people wouldn't have any actual access, they just have the clearance that would allow them to have access if they are in a role that requires access.
Well you're going to apply for it but you're not necessarily going to get it.
Either way, we have propensity to over classify things in the government and that's a whole other argument.
1. Chinese blamed for stealing Los Alamos secret by stashing hard drives behind a copy machine and grabbing them later.
2. Chinese engineer at JPL worked there for decades and was thought to be a nice family in Pasadina - but lived in a really super spartan house and the wife was the engineer's handler and their kids were the mules to haul data back to ccp
3. China's trickle hack on Lockheed by phishing employees who had attended defense conferences
4. China hacking Lockheed providers in Taiwan with an air gap and sneaker-net to gain access to Lockheed laptops via USB exploits (this was one of the factors, IIRC why epoxy in USB ports was common) -- ((But if you ever had any SGI O2 machines -- there was an additional port (serial I think - I don't think they were USB) but this 'option' was several thousand more $ -- but it was on every machine and all you had to do was punch out the plastic cover from the case)
5. Israel + USA hacking Iran via STUXNET in the same method with air-gaps etc.
6. The guy who worked at oak ridge, took on a Russian Mail Order Bride and got her a job in oak ridge (accounting I think, I can't recall) -- and it turned out she was a Russian handler, but they denied it -- but everyone knew that every single person from the USG who went to Russia was assigned a female handler, and these handlers were highly trained, and they had several levels of handlers above them to ensure non-defection chain-of-custody-of-intel.
---
I had a few more specific to nukes - but I got distracted - Ill update if I recall the others.
Some of the above have REALLY good documentaries on them. Some of them are known by fewer people - but they are not secret breaches... they got memory-holed.
1. https://www.nytimes.com/2000/06/17/us/missing-nuclear-data-f...
2.? -- https://en.wikipedia.org/wiki/Wen_Ho_Lee (I am not sure if I am conflating these with another case.)
5. https://www.youtube.com/watch?v=rOwMW6agpTI
6. I cant find 6..
I was watching this at the time and... yeah, ex Q cleared at the time, and NYT revealed some of its underlying profit driven sleazy motivations with that hack job.
The others could be legit, I have no idea. But be careful before the evidence gets brought to trial and a guilty verdict is obtained.
Snowden showed and I can confirm, from decades earlier, there's a lot of workarounds going on daily just to get shit done. Some were absurd.
Bay Area lab, lot of weirdos (who I liked a lot) living in that creepy scene. Forces of control over a cute zoo of nerds.
https://krebsonsecurity.com/2016/09/congressional-report-sla...
https://en.wikipedia.org/wiki/Office_of_Personnel_Management...
That number is classified.
As of 2017, approximately 2.8 million people held TS[1]. A sizable percentage of those people are also probably TS//SCI.
Edit: Uncited, from Wikipedia:
> In general, military personnel and civilian employees (government and contractor) do not publish the individual compartments for which they are cleared. While this information is not classified, specific compartment listings may reveal sensitive information when correlated with an individual's résumé. Therefore, it is sufficient to declare that a candidate possesses a TS/SCI clearance with a polygraph.
[1]: https://about.clearancejobs.com/hubfs/Clearancejobs_Images_N...
Then you quote TS clearances. With a guess at how many have SCI access.
The amount of people who have TS/SCI clearances with a Full Scope Polygraph is classified.
Access to some security comparments ("Sensitive Compartmented Information") might require both a need to know, and either a Counter-Intelligence or Full Scope polygraph examination. If you have a current (non-expired) TS/CI Poly or TS/FS Poly investigation, could be quite valuable to a defense contractor, because it can take a while (potentially months or years) and cost $$$ for you to get that investigation, which combined with the need to know, would be necessary to get you access to certain classified compartments which might be necessary for you to work on a particular project. Otherwise, you might have the necessary computer skills, but without having the requisite security clearance investigation having been done on you, the defense contractor might have to hire you and have you work on non-classified aspect of the projects for months and months (or if you are a new college grad, maybe even twiddling your fingers) until the security clearance investigation had been completed.
Realistically, they are probably very effective at verifying whether normal people have secrets that could be used for blackmail, as you say, because of the psychology, even if the machine isn't actually doing anything.
Anecdotally, I've heard of security interviews (for government intelligence, I can't give context) where the interviewer just says "i'll know if you lie". For the average person this is enough to make them flustered if asked an awkward question.
https://www.reuters.com/article/us-usa-trump-clearances/whis...
And basically everyone with the SCI designation could get a call to get a poly anytime, but I've never had one and know people who've had their clearances for years without getting that call (and I know a couple people who had them before the government finished that person's background investigation, so go figure). Some agencies care quite a bit, others not at all.
My boss told me, "just assume they know the answer to any question they ask and tell the truth, regardless of what it is."
Clearances just standardize that, so you can trust that it's been performed within X years. You still don't share material without a requirement, you've just outsourced the other half.
The DOE isn’t the CIA
Not necessarily. Maybe in DoD land, but there's also a different system (uses similar terminology) for the State Department, and Department of Education (and some others) also has a thing called "Public Trust Clearance" and they involve different background checks (which aren't transferable). But the DoD clearance is the one that takes much longer to complete.
Though someone has to organize it so I guess it gets blurrier at much higher levels but that’s not the level we talk about with most dumb conspiracy theories/Qanon specifically
If you clear millions of people, that sounds unsafe to the general public, but it isn't really because the clearance is only a confirmation that nothing is wrong in your background. It doesn't give you any access.
Us: “UFOs!”
Him: “Oh, you mean FUOU? That goes by CUI these days.”
Us: “No, UFOs like Aliens!”
Him: “GET THE HELL OUT OF MY OFFICE!”
So yeah, even with TS/SCI I couldn’t couldn’t get access to aliens :|
FOUO - A doctors patient list. That isn’t the business of the public and should not be released. That data does not contain PII, patient health data, and is not protected as a matter of security but it is still protected data.
Classified - Data that is restricted from public release. This is lowest level of protection and is intentionally vague.
Secret - Information that if disclosed can be used to harm people or disrupt government operations by adversaries. This includes information like convoy travel schedules and communications outages. Secret data is typically really boring office information in otherwise more exciting work.
Top Secret - This information, if disclosed, will likely result in embarrassment to the extent that national security or diplomatic relations suffer or that the intentional imminent danger of death or bodily harm occurs to people.
e.g. all Secret is Classified but not all Classified is Secret.
https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/do...
Is it possible that you actually learned some important private cryptographic key? If so, that number might have been sexy but you just didn’t actually have visibility into a bigger picture?
No, it was more like "this chainsaw cuts through 3 inches of wood per second and it falls apart in half a minute, so the amount of wood you can cut with it is [REDACTED]"
No, it was more like "this chainsaw cuts through 3 inches of wood per second and it falls apart in half a minute, so the amount of wood you can cut with it is [REDACTED]"
That actually sounds like a pretty secure password.
But where would the x or y have ever been written publicly?
a lot of nuclear navy info is decades old and shares the same classification level of new, novel tech. suffice it to say submarines are doing cool things and i certainly dont know the half of it.
Is this serious?
In IT projects, most of us with any kind of clearance NEVER see anything controlled. But the clearance is needed in case we ever need to see controlled information, in order to write code, debug it, operate it, or train others to use the system.
Though some may eventually end up on a system or program whose very existence is classified. And that fact alone, is often not very special, and may be the only thing they ever "know" that's controlled.
It sounds unsafe once all the information collected on those millions of people is placed in a central location and then hacked by or leaked to a nation-state level adversary.
If you said that 99% of them don't actually have power or access, it could be true, but irrelevant if an adversary has essentially 100% and unlimited resources to review them and double check the work.
>the clearance is only a confirmation that nothing is wrong in your background
In theory. The security clearance investigators are not perfect, and moreover, it's been publicly reported that sometimes contractors have falsified records showing they performed investigations. Statistically, X% are going to be flawed.
If an adversary has ~100% of the records, then think what they can do by reviewing them. Compromising someone doesn't require an earthshattering discovery because the cardinal sin is failure to disclose.
Let's say, for example, a person smoked pot a few times. From what I've read, that's generally not a big deal as long as you aren't doing it currently and don't lie about your history.
(The DOE rule seems to be that if you haven't used illegal drugs for two years, then they're not disqualifying per se, depending on a holistic look at a person)
But if an adversary has the entire investigation and every other piece of information that the federal government has on every employee, and they can determine that a given person did in fact conceal anything, then it is leverage to compromise them. Do X or you will be exposed as having lied. Or even "do X or you will be framed as having lied". It could be just enough to get someone to perform some action that further compromises them, and so on.
The more people this is done to, the more it snowballs. They could say "this higher up person works for us, so if you don't cooperate they will help us frame you for X". And it could be true, so how can a person verify?
If they have everyone's investigation, then all of the people who do have access to important things are at risk, and anyone who is truly spotless cannot be sure who is compromised.
Ancillary information like fingerprints makes it even worse, as all covert agents anywhere can in principle be detected and eliminated. This type of apocalypse being quiet, an absence of reporting on it wouldn't be evidence against.
I deduce that the whole scenario likely happened starting several years ago, based on public information, summarized at:
https://en.wikipedia.org/wiki/Office_of_Personnel_Management...
I am not making a categorical statement that seeking a cleared federal position is a mistake, but consider the gravity of the decision to trust the system if you do.
If people are saying it was hacked by country X, it might be strategic to share it with a couple other countries and let them cause chaos. Then, with clean hands, make speeches tut-tutting about the degeneracy of American culture and democracy.
Trying to orchestrate anything, by actually controlling the US government has a lot of potential downside, and what really is the strategic goal?
Presumably all the countries on the list that the US doesn't like want one simple thing - to be treated (as countries) equally to US allies. It's not necessary to make the US do anything, just to make us incapable of doing anything and unable to be trusted by allies. And that's inherently much easier than control. Not only that, but it doesn't require trust and cooperation among themselves to an unrealistic degree.
I was in a internal software tools department at a large company that did some classified work. Because I might need to interact with departments doing classified work I had to apply for Top Secret classification. This was required just in case I might have to get into those areas of the company to teach them how to use our in-house compiler.
(I didn't finish the process of obtaining the classification because of my desire to return to grad school in a different city. I never touched or even saw a classified document despite having Secret clearance already.)
(And in reality I didn't even need that because several people kept their lab key in plain sight on their desk in their open office 24/7...)
Exactly.
"Need to know basis." is the key phrase here.
The clearance is just the tag that gets you in the door. If you do not have a specific need to access the information to do your specific job, you do not have any right to access it.
AFAIK, deliberately taking steps to access info beyond your need to know -- even if it is within your clearance level -- is grounds for disciplinary action or prosecution.
So the TS/Q-cleared janitor, parts contractor, or engineer from the other project who gets found browsing in TS/Q file cabinet is waaay out of line,and likely in big trouble.
Similar status applies to the ESA, ITER, and many others.
I've gone through DOE/NNSA processes and what I needed for plant access (pentesting for a utility) was through NRC and a bit different.
I think clearence has been overused as a dramaturgical element a lot but it sure as hell sounds cool.
I was working with rad-hardened semiconductors in the context of weapons effects as well as natural space radiation.
Q clearance is anyone with a CNWDI modifier, so that's secret and top secret.
Note, one of the very unusual things about a Q is access control for both information AND physical material.
<<
Q: Back up a minute! You just mentioned a "Q" access authorization. What is that and how does it relate to the Top Secret, Secret, and Confidential clearance terminology I'm familiar with?
A: Top Secret, Secret, and Confidential security clearances refer back to the level of National Security Information to which an individual may have access. Because DOE is granting access to Restricted Data and special nuclear material, it uses different terminology. Generally speaking, there are two types of access authorizations, the L and the Q. The L access authorization corresponds to the background investigation and administrative determination similar to what is completed by other agencies for Confidential and Secret National Security Information access clearances and the Q access authorization corresponds to the background investigation and administrative determination similar to what is completed by other agencies for a Top Secret National Security Information access clearance. In addition, because RD information is more sensitive than NSI information, access to Secret Restricted Data requires a Q access authorization.
>>
[1] https://www.energy.gov/ehss/security-policy-guidance-reports...
It’s a fast track to a high level position at one of the nuclear defense labs doing amazing work (fusion, defense, detection, etc).
It’s non-binding (I currently work in tech), and highly supportive of the individual fellows.