Crossing the Rubicon

66 CHAPTER SEVEN Crossing the Rubicon “What I came to feel is that a regime that is described as a national security agency has stopped representing the public interest and has instead begun to protect and promote state security interests. “ --Edward Snowden, interviewed in Moscow 2014 Soon after Snowden failed to get a SES job at the NSA, he intensified his rogue activities. At that time, Dell was tasked with building an enhanced backup system for the NSA in Hawaii. Deputy Director Ledgett explained that part of Snowden’s job as a system administrator under contract to Dell was transferring files held at Fort Meade to back-up computers in Hawaii. He “was moving copies of that data there for them, which was perfect cover for stealing the [NSA] data.” Snowden took advantage of this cover. Snowden expanded his own rogue operation, as Ledgett reconstructed the breach, through the fall and winter of 2012. There was little risk of him getting caught. The security measures at the Hawaii base presented no obstacles to him since, as a system administrator, he had privileges that allowed him to copy documents that had not been encrypted. Indeed, it was part of the process of building the backup system. The flaw he had pointed to in Japan in which system administrators working solo could safely steal files also existed in Hawaii. This time, however, instead of bringing it to the attention of the NSA, he used it to himself steal files. He could be confident that his 2012 thefts of documents would go undetected because the NSA’s base had not yet installed an auditing system. Such real-time auditing of the movement of documents, which was done at NSA headquarters in Fort Meade and most of the NSA’s regional facilities, had not yet been installed at the Hawaii base because a lack of bandwidth prevented the safe upgrading of the software. This auditing software was scheduled to be installed after the backup system was completed in 2013. The Kunia base was one of the last NSA bases which did not monitor suspicious transfers of files on a real-time basis. Snowden certainly was certainly aware of this deficiency. He later pointed out in his interview in Wired magazine in Moscow that the NSA base where he worked did not have an “audit” mechanism. This security gap allowed Snowden, using his system administrator’s credentials, to copy classified data to a thumb drive without anyone being able to trace the copied data back to him. And, according to the NSA’s subsequent damage assessment, he stole many thousands of pages while working for Dell in 2012 before he contacted journalists. Deputy Director Ledgett subsequently reported that the NSA analysis the 58,000 documents that were given by Snowden to journalists in June 2013 showed that most of them were taken by Snowden while he was still working at Dell. HOUSE_OVERSIGHT_020218