Pentagon Will Investigate NSA Crackdown on Would-Be Snowdens

Image via Shutterstock

AA Font size + Print

The Defense Department inspector general has Congress' attention with a new probe into rogue IT employees.

A Defense Department inspector general is initiating a review of a National Security Agency crackdown on computer users who have access to too much information. 

Be it a rogue contractor or an unknowing employee with sloppy login and logoff habits, insiders are a major threat to U.S. secrets, sayresearchers and federal officials

Congress has taken notice.

A classified addendum to the 2016 Intelligence Authorization Act contained an “inspector general classified reporting requirement” relating to NSA internal security protections, according to a Jan. 6 memo from Carol Gorman, assistant IG for readiness and cyber operations. 

Specifically, we will determine whether National Security Agency processes and technical controls are effective to limit privileged access to National Security Agency systems and data and to monitor privileged user actions for unauthorized or inappropriate activity,” she said in the document, which was addressed to top brass at the Pentagon.

In the wake of excessive downloading by ex-NSA systems administrator Edward Snowden, the agency has been trying to keep a closer eye on users with sweeping access to files. For example, as of 2013, there is a “two-man” policy that two people must be present when sensitive information is read or moved.  

The insider-threat inspection is scheduled to start this month. 

It is one in a series of reviews of safeguards in place to protect the NSA network and infrastructure. The whole audit will examine whether its controls have actually improved the security of the agency’s “systems, data and personnel activities,” Gorman said. 

She said she is open to suggestions from management on adding or revising the objectives of the assessment. 

Another federal government overseer, the Government Accountability Office, recently found the Pentagon, as a whole, needs to watch abnormal computer usage by employees more closely.

Half of a sample of military organizations assessed could not tell what average network activity looks like in their offices, according to an unclassified version of an April 2015 audit. “A baseline of normal activity” is key to curbing inside hacks, the report stated. 

During the past few years, NSA has wrapped access restrictions around each file that enters its modernized IT system so the agency can log user activity with eagle eyes, according to the agency.

NSA told Nextgov in April 2015 any piece of data ingested by agency systems since 2013 has been tagged with a digital trail, including where it came from and who is authorized to see it.

Close [ x ] More from DefenseOne

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Top 5 Findings: Security of Internet of Things To Be Mission-Critical

    As federal agencies increasingly leverage these capabilities, government security stakeholders now must manage and secure a growing number of devices, including those being used remotely at the “edge” of networks in a variety of locations. With such security concerns in mind, Government Business Council undertook an indepth research study of federal government leaders in January 2017. Here are five of the key takeaways below which, taken together, paint a portrait of a government that is increasingly cognizant and concerned for the future security of IoT.

  • Coordinating Incident Response on Posts, Camps and Stations

    Effective incident response on posts, camps, and stations is an increasingly complex challenge. An effective response calls for seamless conversations between multiple stakeholders on the base and beyond its borders with civilian law enforcement and emergency services personnel. This whitepaper discusses what a modern dispatch solution looks like -- one that brings together diverse channels and media, simplifies the dispatch environment and addresses technical integration challenges to ensure next generation safety and response on Department of Defense posts, camps and stations.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation


When you download a report, your information may be shared with the underwriters of that document.