Pentagon Will Investigate NSA Crackdown on Would-Be Snowdens

Image via Shutterstock

AA Font size + Print

The Defense Department inspector general has Congress' attention with a new probe into rogue IT employees.

A Defense Department inspector general is initiating a review of a National Security Agency crackdown on computer users who have access to too much information. 

Be it a rogue contractor or an unknowing employee with sloppy login and logoff habits, insiders are a major threat to U.S. secrets, sayresearchers and federal officials

Congress has taken notice.

A classified addendum to the 2016 Intelligence Authorization Act contained an “inspector general classified reporting requirement” relating to NSA internal security protections, according to a Jan. 6 memo from Carol Gorman, assistant IG for readiness and cyber operations. 

Specifically, we will determine whether National Security Agency processes and technical controls are effective to limit privileged access to National Security Agency systems and data and to monitor privileged user actions for unauthorized or inappropriate activity,” she said in the document, which was addressed to top brass at the Pentagon.

In the wake of excessive downloading by ex-NSA systems administrator Edward Snowden, the agency has been trying to keep a closer eye on users with sweeping access to files. For example, as of 2013, there is a “two-man” policy that two people must be present when sensitive information is read or moved.  

The insider-threat inspection is scheduled to start this month. 

It is one in a series of reviews of safeguards in place to protect the NSA network and infrastructure. The whole audit will examine whether its controls have actually improved the security of the agency’s “systems, data and personnel activities,” Gorman said. 

She said she is open to suggestions from management on adding or revising the objectives of the assessment. 

Another federal government overseer, the Government Accountability Office, recently found the Pentagon, as a whole, needs to watch abnormal computer usage by employees more closely.

Half of a sample of military organizations assessed could not tell what average network activity looks like in their offices, according to an unclassified version of an April 2015 audit. “A baseline of normal activity” is key to curbing inside hacks, the report stated. 

During the past few years, NSA has wrapped access restrictions around each file that enters its modernized IT system so the agency can log user activity with eagle eyes, according to the agency.

NSA told Nextgov in April 2015 any piece of data ingested by agency systems since 2013 has been tagged with a digital trail, including where it came from and who is authorized to see it.

Close [ x ] More from DefenseOne

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Federal IT Applications: Assessing Government's Core Drivers

    In order to better understand the current state of external and internal-facing agency workplace applications, Government Business Council (GBC) and Riverbed undertook an in-depth research study of federal employees. Overall, survey findings indicate that federal IT applications still face a gamut of challenges with regard to quality, reliability, and performance management.

  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

  • GBC Issue Brief: Supply Chain Insecurity

    Federal organizations rely on state-of-the-art IT tools and systems to deliver services efficiently and effectively, and it takes a vast ecosystem of organizations, individuals, information, and resources to successfully deliver these products. This issue brief discusses the current threats to the vulnerable supply chain - and how agencies can prevent these threats to produce a more secure IT supply chain process.

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

  • Information Operations: Retaking the High Ground

    Today's threats are fluent in rapidly evolving areas of the Internet, especially social media. Learn how military organizations can secure an advantage in this developing arena.


When you download a report, your information may be shared with the underwriters of that document.