Why is this a bigger problem that just "deploy new encryption keys and revoke the old ones" If that is a big problem, then focus on that because keys can leak in any number of ways and it's something you need to be able to handle. I'd be surprised if they are not routinely rotated fairly frequently regardless.
Radio has a lot more to it than just keys. For example, frequency hopping is a big thing, and which frequencies it jumps between, when, and why (i.e. as some sort of anti jamming strategy) are all important details which could be established by inspecting the equipment.
That said, the mention of the Motorola programming software does make this sound more like a base security/policing problem than actual operational infrastructure.
I don’t understand how this is security. Wouldn’t an adversary just listen on all channels and pick up the rest of the communication on the newly detected frequency?
Frequency hopping is actually not considered a secure communication method in military circles, nor is it designed to be. Frequency hopping is designed to provide robust communication during electronic warfare scenarios (jamming).
Military infrastructure isn't always as well-engineered as it should be all the time. It can be very costly and time consuming to deploy new encryption keys, especially for technologies like radios. It's not as simple as deploying a configuration file or running `ssh-keygen` and publishing a few artifacts. Many devices need to be rekeyed by hand, which can be labor intensive depending on the size of the inventory. Additionally, sometimes new hardware needs to be hand-delivered to the appropriate organizations for keys to function.
> officials found that the department couldn’t account for about 61 percent of its assets.
> McCord said the department has made progress toward a “clean” audit in the past year, but later added “we failed to get an ‘A.’...I would not say that we flunked.
Good to know that by US government standards, a 61% is an acceptable passing grade...
You’re missing the “compartmentalized” nature of TS/SCI projects. You would need many, many auditors or the paperwork would be enormous to be cleared for each one.
Yes it’s technically possible, but the current model doesn’t support moving between compartments easily.
What's odd is that at the lower levels people will absolutely freak out if a computer monitor (~$300?) can't be located. I guess it's not small items like that that add up to the billions missing, it's large/expensive things that are missing.
When I was at about 20, the comptroller at my employer told me that you can make mistakes on big important things and people may not notice, but errors in petty cash will always be noticed.
Overpriced contracts sounds like something easily accounted for. This is stuff that's literally 'missing' during audits by teams of professional accountants.
The whole point of war and defense narratives is to make people afraid so you can override every precaution and appropriate and dissipate resources freely. That's the logic behind DoD mega spending, 'war on drugs', war on terror' narratives, right wing moral panics / culture wars populism, and organized crime protection rackets.
Make people afraid, they will give you anything to make the threat disappear. Including their freedom and dignity. There is no single entity involved in this game that is not shady and corrupt to its core.
The article presented no evidence of other countries getting access to that data. Just a 48yo American engineer who allegedly shouldn't have had access. Of course, someone could've snooped on his home network, I guess.
The article said that he was selling radio equipment. I’m sure all of the buyers will be getting contacted and investigated to ascertain if foreign buyers were involved.
Many 'military' radios are commercial or have nostalgic value. The article is short on details, and given the spottiness of the records of this unit (obvious they aren't tracking property as required by DoD policy considering this was allowed to occur) it's entirely possible this guy just owns DRMO'ed equipment himself he buys/sells. Take that out of the mix, and the rest of the 'evidence' point to this being an overworked sysadmin/engineer who takes his work home with him. It's a common occurrence in every workplace even the DoD; many of the NSA leaks is from individuals trying to work on their personal computers at home.
> Installer files which were recovered in the search opened with a “CONFIDENTIAL RESTRICTED” pop-up, according to Forbes.
Woah woah woah. Are you saying this software said it's confidential? Well let me tell you something about this comment. This comment is confidential restricted!
Marking systems and documents is a critical part of security.
It makes sure that you can prove that everyone is put on notice that misuse is subject to extreme punishment. This helps prevent accidental disclosure (Oh, I didn't think confidentiality applied to this), and it helps prove the case should anyone violate the rules.
isn't the security benefit from people genuinely not being confused and making accidental disclosures? You phrased it more focused on penalties applied after a failure which to my novice understanding is too late (and ineffective anyway).
CONFIDENTIAL is one of the collateral security levels. It goes UNCLASSIFIED (this data can be also additionally marked CUI/FOUO, for official use only), CONFIDENTIAL, SECRET, and TOP SECRET. S and TS have compartments which further gate access to information.
The software being marked CONFIDENTIAL means that it is classified software, the exposure of which can cause damage to national security.
While true, confidential restricted is not a US classification marking. It sounds more like the language on a clickwrap license installer, like what you would get for the radio programming software.
This sounds like not much. It would allow an eavesdropper to overhear LEO-type conversations or basic operational discussion but unlikely to be anything actual classified.
I have no idea of course. I don't even know where Arnold AFB is!
> The warrant also recounted how witnesses and co-workers informed investigators that the engineer had allegedly “sold radios and radio equipment, worked odd hours, was arrogant, frequently lied, displayed inappropriate workplace behavior and sexual harassment, had financial problems, and possessed [Arnold air force base land mobile radio] equipment”.
> It added that a colleague had reported him twice due to “insider threat indicators” as well as unauthorized possession of air force equipment, according to investigators.
There isn't a timeline provided, so hopefully those insider threat reports were relatively recent?
56 comments
[ 2.6 ms ] story [ 108 ms ] threadThat said, the mention of the Motorola programming software does make this sound more like a base security/policing problem than actual operational infrastructure.
Do you know the Department of Defence has never passed a audit?
https://thehill.com/policy/defense/3740921-defense-departmen...
> McCord said the department has made progress toward a “clean” audit in the past year, but later added “we failed to get an ‘A.’...I would not say that we flunked.
Good to know that by US government standards, a 61% is an acceptable passing grade...
Due to the compartmentalized nature of some of the programs (with good reason), it’s infeasible the DoD would ever pass a traditional audit.
Much like the CIA intentionally obfuscates funding for 3rd parties.
Yes it’s technically possible, but the current model doesn’t support moving between compartments easily.
This is a whole different can of worms :)
---
[1] https://nypost.com/2023/07/27/senate-dems-oppose-oversight-o....
Make people afraid, they will give you anything to make the threat disappear. Including their freedom and dignity. There is no single entity involved in this game that is not shady and corrupt to its core.
We don't know that at all.
Absence of evidence is not evidence of absence.
> Installer files which were recovered in the search opened with a “CONFIDENTIAL RESTRICTED” pop-up, according to Forbes.
Woah woah woah. Are you saying this software said it's confidential? Well let me tell you something about this comment. This comment is confidential restricted!
It makes sure that you can prove that everyone is put on notice that misuse is subject to extreme punishment. This helps prevent accidental disclosure (Oh, I didn't think confidentiality applied to this), and it helps prove the case should anyone violate the rules.
I mentioned both:
- It prevents people from not knowing something is sensitive and mishandling information
- It prevents people from claiming that they didn't know something was sensitive after mishandling information
The software being marked CONFIDENTIAL means that it is classified software, the exposure of which can cause damage to national security.
This sounds like not much. It would allow an eavesdropper to overhear LEO-type conversations or basic operational discussion but unlikely to be anything actual classified.
I have no idea of course. I don't even know where Arnold AFB is!
[1] https://www.energy.gov/sites/prod/files/hss/Classification/d...
Except for the sloppy enthusiast contractor too deep in the criminal tendencies end of the pool... his life probably just got rather difficult.
Having recently rewatched Sneakers I'm struck by how much what the article describes of his home overlaps with characters like Mother(Akroyd).
> It added that a colleague had reported him twice due to “insider threat indicators” as well as unauthorized possession of air force equipment, according to investigators.
There isn't a timeline provided, so hopefully those insider threat reports were relatively recent?