WikiLeaks’ Cablegate Links State Dept. Bureau of Diplomatic Security to Madness 2011/09/28
Posted by nydawg in Archives, Digital Archives, Digital Preservation, Electronic Records, Information Technology (IT), Media, Privacy & Security, Records Management, WikiLeaks.Tags: appraisal, Bradley Manning, cablegate, DoD 5015.2, wikileaks
add a comment
For the last year or so, I’ve been fascinated by the whole WikiLeaks Cablegate story. As I posted previously, there are a number of factors that contribute to this story which make it particularly interesting for people concerned with records management and best practices for accessing and sharing information. In my opinion, Private first class Bradley Manning is a fall guy (lipsynching to Lady Gaga), but problems revealed serious systemic malfunctions. So I was very interested to read this article by Andy Kroll: “The Only State Dept. Employee Who May Be Fired Over WikiLeaks“.
“Peter Van Buren is no insurgent. Quite the opposite: For 23 years he’s worked as a foreign service officer at the State Department, and a damn good one from the looks of it. He speaks Japanese, Mandarin Chinese, and Korean; served his country from Seoul to Sydney, Tokyo to Baghdad; and has won multiple awards for his disaster relief work. So why was Van Buren treated like a terror suspect by his own employer? For linking to a single leaked cable dumped online by WikiLeaks earlier this month.”
Well, this led me to read a TomDispatch.com posting by Van Buren himself which offers a clear-headed look at the madness! For one thing, Van Buren got into a heap of trouble and was “under investigation for allegedly disclosing classified information” for LINKING to a WikiLeaks document which was already on the Web! As he put it: “two DS agents stated that the inclusion of that link amounted to disclosing classified material. In other words, a link to a document posted by who-knows-who on a public website available at this moment to anyone in the world was the legal equivalent of me stealing a Top Secret report, hiding it under my coat, and passing it to a Chinese spy in a dark alley.”
Van Buren goes on to analyze the situation by stating: “Let’s think through this disclosure of classified info thing, even if State won’t. Every website on the Internet includes links to other websites. It’s how the web works. If you include a link to say, a CNN article about Libya, you are not “disclosing” that information — it’s already there. You’re just saying: “Have a look at this.” It’s like pointing out a newspaper article of interest to a guy next to you on the bus. (Careful, though, if it’s an article from the New York Times or the Washington Post. It might quote stuff from Wikileaks and then you could be endangering national security.)”
And, for me, the cherry on the top, and something I’ve been trying to state for most of the last year (including at the Archivists Round Table of Metropolitan New York meeting in January 2011), is the fact that “No one will ever be fired at State because of WikiLeaks — except, at some point, possibly me. Instead, State joined in the Federal mugging of Army Private Bradley Manning, the person alleged to have copied the cables onto a Lady Gaga CD while sitting in the Iraqi desert. That all those cables were available electronically to everyone from the Secretary of State to a lowly Army private was the result of a clumsy post-9/11 decision at the highest levels of the State Department to quickly make up for information-sharing shortcomings. Trying to please an angry Bush White House, State went from sharing almost nothing to sharing almost everything overnight. They flung their whole library onto the government’s classified intranet, SIPRnet, making it available to hundreds of thousands of Federal employees worldwide. . . . . State did not restrict access. If you were in, you could see it all. There was no safeguard to ask why someone in the Army in Iraq in 2010 needed to see reporting from 1980s Iceland. . . . . Most for-pay porn sites limit the amount of data that can be downloaded. Not State. Once those cables were available on SIPRnet, no alarms or restrictions were implemented so that low-level users couldn’t just download terabytes of classified data. If any activity logs were kept, it does not look like anyone checked them.”
In other words, by pointing the finger of blame at a few (two) bad apples (Pfc Manning and Foreign Services Officer/ Author Van Buren), “… gets rid of a “troublemaker,” and the Bureau of Diplomatic Security people can claim that they are “doing something” about the WikiLeaks drip that continues even while they fiddle.” Yet, the State Department and the Department of Defense still refuse to acknowledge the systemic problems of trying to provide UNRESTRICTED and UNTRACEABLE ACCESS to ALL CABLES to all LEVELS of employees from the highest administrative levels at State and Defense to the lowliest of the low (Private first class on probation or a contractor, like Aaron Barr, working in White Hat or Black Hat Ops.) Okay, according to Homeland Security Today, there’s 3 million people (not just Americans, btw) with “secret” clearance and “only” half a million with access to SIPRNet!
This still strikes me as an example of the US acting like ostriches and burying its head so we will not have to acknowledge the serious problems that are all around us. Mark my words: the system is still broken, and even though certain changes have been instituted (thumb drive bans), we have a much more serious and systemic problem which few dare to acknowledge. What’s the solution? Better appraisal and better records management!
No one will ever be fired at State because of WikiLeaks — except, at some point, possibly me. Instead, State joined in the Federal mugging of Army Private Bradley Manning, the person alleged to have copied the cables onto a Lady Gaga CD while sitting in the Iraqi desert. That all those cables were available electronically to everyone from the Secretary of State to a lowly Army private was the result of a clumsy post-9/11 decision at the highest levels of the State Department to quickly make up for information-sharing shortcomings. Trying to please an angry Bush White House, State went from sharing almost nothing to sharing almost everything overnight. They flung their whole library onto the government’s classified intranet, SIPRnet, making it available to hundreds of thousands of Federal employees worldwide.
WikiLeaks’ Cablegate and Systemic Problems 2011/09/06
Posted by nydawg in Best Practices, Digital Archives, Electronic Records, Information Technology (IT), Media, Privacy & Security, Records Management, WikiLeaks.Tags: appraisal, Bradley Manning, cablegate, DoD 5015.2, electronic records, wikileaks
1 comment so far
WikiLeaks Cablegate
Since late November of last year, the whole world has been watching as WikiLeaks got its hands on and slowly released thousands of classified cables created and distributed by the US over the last four decades. As you may recall, the suspected leaker was Army Private First Class Pfc Bradley Manning who, undetected, was able to locate all the cables, copy them to his local system, burn them to CD-R (while allegedly lipsyncing Lady Gaga), and uploading an encrypted file to WikiLeaks. (I’ve written previously , so I won’t get too detailed here.)
But last week, the story changed dramatically when The Guardian revealed that “A security breach has led to the WikiLeaks archive of 251,000 secret US diplomatic cables being made available online, without redaction to protect sources. WikiLeaks has been releasing the cables over nine months by partnering with mainstream media organisations. Selected cables have been published without sensitive information that could lead to the identification of informants or other at-risk individuals.” To further confuse matters related to the origin of this newest leak, “A Twitter user has now published a link to the full, unredacted database of embassy cables. The user is believed to have found the information after acting on hints published in several media outlets and on the WikiLeaks Twitter feed, all of which cited a member of rival whistleblowing website OpenLeaks as the original source of the tipoffs.” The Cablegate story, with all its twists and turns over the months, has left a big impression on me and, as an archivist and records manager, I think it is important to strip this story of all its emotionality and look at it calmly and rationally so that we can get to the bottom of this madness.
The first problem I have with the story, or more specifically, with the records management practices of the Defense Department is the scary fact that a low-level Private first class (Pfc) would have full access to the Army’s database. This became a bit scarier when we learned that Pfc Manning used SIPRNet (Secret Internet Protocol Router Network) to gain full access to JWICS (Joint Worldwide Intelligence Communications System) as well as the [cilivian/non-military] diplomatic cables generated by the State Department.
So the first question I had to ask was: why does DoD have access to the State Department’s diplomatic cables, are they spying on the State Department?! Well, maybe, but even if not, this staggering fact from a different Guardian article sent shivers down my spine: “The US general accounting office identified 3,067,000 people cleared to “secret” and above in a 1993 study. Since then, the size of the security establishment has grown appreciably. Another GAO report in May 2009 said: “Following the terrorist attacks on September 11 2001 the nation’s defence and intelligence needs grew, prompting increased demand for personnel with security clearances.” A state department spokesman today refused to say exactly how many people had access to Siprnet.”
Other factors that scare the heck out of me related to “bad records management” and WikiLeaks Cablegate are the fact that there is a lack of CONTROL of these assets (they store everything online?! Really?!); the DoD and State Department don’t use ENCRYPTION or cryptographic keys or protected distribution systems; the names of confidential sources were not REDACTED in the embassy before uploading and sharing the cables with the world; their RETENTION SCHEDULES do not allow for some cables to be declassified and/or destroyed (so they keep everything online for decades and/or years); the majority of cables were UNCLASSIFIED suggesting that so many cables are created that they don’t even have enough staff to describe and CLASSIFY them in a better way? The DoD didn’t have a method for setting ACCESS PRIVILEGES, or PERMISSIONS or AUTHORIZATION to ensure that a Pfc who is on probation would not be able to access (and copy and burn to portable media) all those cables undetected?! There’s a question about password protection and authorization, but those problems could probably be covered with better ACCESS PRIVILEGES and PERMISSIONS. Another question that leaves archivists confused is the idea that there seems to be limited version control. In other words, it seems as if once a cable is completed, someone immediately uploads it, and then if the cable is updated and revised, a second cable will be created and uploaded. This doesn’t seem to be a very smart way of trying to control the information when multiple copies may suggest differing viewpoints.
But perhaps the scariest part of the whole WikiLeaks’ Cablegate madness is simply that there was no TRACKING or TRACING mechanism so that the DoD could, through LOGS, trace data flows to show that one person (or one machine or one room in one building or whatever) had just downloaded a whole collection of CLASSIFIED materials! [From the IT perspective, large flows of data may actually impact data flow speeds for other soldiers on the same network!] And the fact that Pfc Manning was able to burn the data to CD-R suggests that when IT deployed the systems they forgot or neglected to DISABLE the burn function on a classified network! (Okay, they’ve made some recent changes, but is it too late?!)
Many assume that Digital Forensics will provide a new way to authenticate data. Well, if so, then why can’t they run a program on the cables and find out which system was used to burn the data and then trace the information back to the person who was using the machine at that time, as opposed to putting a soldier in jail, in solitary confinement, awaiting trial, convicted merely on a hearsay online chat he had with a known hacker?! One other important consideration that also scares me: The military uses Outlook for their email correspondences, and Outlook creates multiple PST files. As the National Journal puts it: “So how did Manning allegedly manage to get access to the diplomatic cables? They’re transmitted via e-mail in PDF form on a State Department network called ClassNet, but they’re stored in PST form on servers and are searchable. If Manning’s unit needed to know whether Iranian proxies had acquired some new weapon, the information might be contained within a diplomatic cable. All any analyst has to do is to download a PST file with the cables, unpack them, SNAP them up or down to a computer that is capable of interacting with a thumb drive or a burnable CD, and then erase the server logs that would have provided investigators with a road map of the analyst’s activities.”
Obviously the system was broken, informants’ security was compromised, our secrets are exposed, and the cat is out of the bag! Yet even now, many are unwilling to listen to or heed the lessons we need to learn from this debacle. Back in January, I attended a WikiLeaks panel discussion hosted by the Archivists Round Table of Metropolitan New York and was surprised to hear that most of these issues raised above were ignored. I tried to ask a question regarding the systemic problems (don’t blame Manning), but even that was mostly ignored (or misunderstood) and not answered by everyone on the panel.
In my opinion, we have very serious problems related to best practices for records management. If you look closely at DoD 5015.2, you can see that the problems are embedded in the language for software reqs, and nobody is looking at these problems in the ways that many archivists or records managers do (or should). But honestly, the most insightful analysis and explanation were confessed by Manning himself: ““I would come in with music on a CD-RW labeled with something like ‘Lady Gaga,’ erase the music then write a compressed split file,” he was quoted in the logs as saying. “[I] listened and lip-synced to Lady Gaga’s ‘Telephone’ while exfiltrating possibly the largest data spillage in American history. Weak servers, weak logging, weak physical security, weak counter-intelligence, inattentive signal analysis … a perfect storm.”
So maybe it is time for the military, the US National Archives, and all computer scientists and IT professionals to stop relying on computer processing and automated machine actions and start thinking of better ways to actually protect and control their classified and secret data. Perhaps a good first move would be to hire more archivists and try to minimize the backlog quantity of Unclassified cables! Or maybe it’s time to make sure that the embassies take responsibility for redacting the names of their sources before uploading the cables to a shared network? And maybe it is time to consider a different model than the life cycle model which will account for the fact that often these cables will be used for different functions by different stakeholders through the course of its existence.
Salman Rushdie’s Papers Accessioned by Emory; Access Thru Emulation 2011/08/19
Posted by nydawg in Digital Archives, Digital Preservation, Electronic Records, Information Technology (IT), Records Management.Tags: access, appraisal, born digital, capture, digital forensics, digital preservation, emulation, migration
add a comment
One of the early stories that encouraged discussion among early nydawg members, was this story in the NYTimes about Emory accessioning author Salman Rushdie’s papers including diaries, notebooks, journals, notes, stickies, four Apple computers, a hard drive and 18 Gigabytes of born-digital materials. The article, “Fending Off Digital Decay, Bit by Bit” is an interesting look at one institution’s attempt to capture and appraise the work of a living artist and attempting to use emulation and migration as a preservation strategy. A few months later, there was a fascinating multi-part series, “Born-Digital: The New Archive part 3“, from World Policy Institute Blog which mentioned the Rushdie model.
“In 2007, Emory acquired Salman Rushdie’s papers, which included a
“hundred linear feet of his paper material, including diaries, notebooks,
library books, first-edition novels, notes scribbled on
napkins, but also forty thousand files and eighteen gigabytes of data
on a Mac desktop, three Mac laptops, and an external hard drive.” Much
has been written about Emory’s important achievement, but it should be
noted that Emory only focused on Rushdie’s Macintosh Performa 5400 to
test the emulation of the complete desktop environment.
As the authors of “Digital Materiality” note, Rushdie’s use of
Stickies (electronic Post-It notes) on his early Mac “provides
insights into [Rushdie’s] tendencies to meld the personal and the
literary” and reinforces the “importance of providing both file-level
access and operating system-level access.” According Kenneth
Thibodeau, in his report on “The State of Digital Preservation,”
Emory’s emulation is technically a step in the right direction but
ultimately a deficient one.
. . .
The Times article goes on to point out: ”
Leslie Morris, a curator at the Houghton Library, said, “We don’t really have any methodology as of yet” to process born-digital material. “We just store the disks in our climate-controlled stacks, and we’re hoping for some kind of universal Harvard guidelines,” she added.
Among the challenges facing libraries: hiring computer-savvy archivists to catalog material; acquiring the equipment and expertise to decipher, transfer and gain access to data stored on obsolete technologies like floppy disks; guarding against accidental alterations or deletions of digital files; and figuring out how to organize access in a way that’s useful.
At Emory, Mr. Rushdie’s outdated computers presented archivists with a choice: simply save the contents of files or try to also salvage the look and organization of those early files.” and “At the Emory exhibition, visitors can log onto a computer and see the screen that Mr. Rushdie saw, search his file folders as he did, and find out what applications he used. (Mac Stickies were a favorite.) They can call up an early draft of Mr. Rushdie’s 1999 novel, “The Ground Beneath Her Feet,” and edit a sentence or post an editorial comment. “I know of no other place in the world that is providing access through emulation to a born-digital archive,” said Erika Farr, the director of born-digital initiatives at the Robert W. Woodruff Library at Emory. (The original draft is preserved.)”
In fact, come to think of it, this was probably the first mention we archivists ever heard of digital forensics! “Located in Silicon Valley, Stanford has received a lot of born-digital collections, which has pushed it to become a pioneer in the field. This past summer the library opened a digital forensics laboratory — the first in the nation. The heart of the lab is the Forensic Recovery of Evidence Device, nicknamed FRED, which enables archivists to dig out data, bit by bit, from current and antiquated floppies, CDs, DVDs, hard drives, computer tapes and flash memories, while protecting the files from corruption.”
As former head of NARA’s Electronic Records Archive Kenneth Thibodeau wrote in 2002 “Overview of Technological Approaches to Digital Preservation and Challenges in Coming Years“
“Every digital object is a physical object, a logical object, and a conceptual object, and its properties at each of those levels can be significantly different. A physical object is simply an inscription of signs on some physical medium. A logical object is an object that is recognized and processed by software. The conceptual object is the object as it is recognized and understood by a person, or in some cases recognized and processed by a computer application capable of executing business transactions.”
In other words, the metadata of a digital object (asset, record, electronic record) needs to accurately describe its content and format and/or medium, context including copyrights, permissions, operating systems, and Intellectual Property holders, and function, purpose, intended audience, etc.
###
nydawg New York Digital Archivists Working Group 