http://www.thedailybeast.com/articles/2011/10/20/intelligence-community-trie... Catching the Next WikiLeaker Oct 20, 2011 12:53 AM EDT A year after the most expansive leak of classified information in U.S. history, the intelligence community is deploying refined big-brother software to monitor the spiesb lifeblood: their computer networks. It is like a scene out of the television show 24. An intelligence officer is surfing a top-secret government file that is out of his normal work portfolio. A computer program alerts a b data analyst,b who then monitors the officerbs computer activity. If the officer acts like a potential leaker, sending an encrypted email or using an unregistered thumb drive, the analyst might push a button and watch a screen video of the officerbs last hour of work. Once a case is made that a leak might be imminent, it is checkmate: the agent is thwarted. That is the kind of scenario Ryan Szedelo, the manager for Raytheonbs SureView software, is describing this week for intelligence professionals in San Antonio shopping for new gizmos at the annual GEOINT conference. The government is already beginning to use the software and others like it in a concerted effort to clamp down on secret leaks. b SureView is designed to capture the next Bradley Manning,b Szedelo said of the Army private who uploaded hundreds of thousands of classified documents from the militarybs secret Internet protocol router network (SIPRnet) onto a remote server affiliated with WikiLeaks. With his secret clearance, Manning had access not only to the raw intelligence reports in Iraq, but also to aircraft videos, analysis from the field in Afghanistan, and candid diplomatic cables from U.S. embassies all over the world. b Had SureView been on Bradley Manningbs machine, no one would know who Bradley Manning is today,b Szedelo said in an interview. SureView is a type of auditing software that specializes in b behavior-based internal monitoring.b It is designed to identify and catch what is known in the counterintelligence trade as the b insider threat,b a trusted user who is willing to steal the secrets he or she is obliged to protect. Until very recently, WikiLeaks had many leaders of the U.S. intelligence community willing to pull back the kind of intelligence sharing started in earnest after the Sept. 11, 2001, attacks. Last October, Director of National Intelligence James Clapper said at a speech in Washington that b the WikiLeaks episode represents what I would consider a big yellow flag.b He added, b I think it is going to have a very chilling effect on the need to share.b wikileaks-security-lake Protesters advocating the release of Bradley Manning on March 20, 2010, in Quantico, Va., Evelyn Hockstein, The Washington Post / Getty Images Today Clapper is taking a different tone. This week at GEOINT, the annual trade show for the intelligence industry, Clapper said one of his top priorities was to merge intelligence collection with intelligence analysis, a process that by definition would require much more sharing among the 16 U.S. intelligence agencies under his direction. What has changed in the last year is the technology to catch the next big leaker. b The trick is, can we allow robust sharing for analytical and operational purposes and protect the information at the same time?b House Intelligence Committee Chairman Mike Rogers (R-Mich.) said in an interview. b I argue yes, there are lots of ways to do it.b Rogers said he favors something called b smart access,b where an intelligence analyst not only would be monitored but would have to be cleared or authenticated to enter specific servers outside his or her purview. b These are just trip wires. I prefer you have to knock on the door to get inbyou should need to be authenticated to get into the next level.b The intelligence community has had auditing software for years. SureView came on the market in 2002. But the programs were buggy and often prone to false positives, alerting a network administrator too often to routine behavior. In the last year, according to three U.S. intelligence officials who asked not to be named, the software has become more automated and easier to apply to larger databases. b The technology has gotten substantially better in the last year,b said Jeffrey Harris, a former head of the National Reconnaissance Office, the intelligence agency responsible for launching spy satellites. b The problem with audit files was it took an army of people to understand them. Now we have rule-driven systems and expert systems that help us reason through the data.b Charles Allen, who served as the first intelligence chief for the Department of Homeland Security, said the base where Manning was stationed in Iraq did have auditing software in place that could have caught him, but it was not yet implemented. b In the future, military intelligence units in the war zones and elsewhere will ensure there is a strong audit capability,b he said. Allen has a point. Earlier this month, President Obama signed a new executive order on protecting classified information. The order created a new b insider threat task forceb inside the intelligence community, chaired by the attorney general and the director of national intelligence. The new directive from the White House is driven in part by new technology. The budget for this kind of counterintelligence software is still secret, but judging from the trade-room floor, itbs a major draw for the U.S. government. The Science Applications International Corporation (SAIC) is offering a software system called Checkmate to detect external threats. A companion product still in development for the internal threat is called Inmate. b Had SureView been on Bradley Manningbs machine, no one would know who Bradley Manning is today.b This kind of auditing software is one growth area in a new era of shrinking intelligence budgets, Lynn Dugle, president of Raytheon Intelligence and Information Systems, told The Daily Beast. b We absolutely think there will be growth in the insider threatbinternal monitoring market,b she said. Trevor Timm, an activist for the Electronic Frontier Foundation who closely watches the legal issues raised by WikiLeaks, said: b The government has every right to secure their own networks, but if they want to really stop leaks, they need to stop classifying so much information that is not really secret.b Timm added: b The government classified a staggering 77 million documents last year, a 40 percent increase on the year before. And a recent report to Congress showed 4.2 million people have classified security clearances. Thatbs more than the city of Los Angeles. As long as the government wonbt address this underlying problem, people will always find ways to leak, no matter the security.b Like The Daily Beast on Facebook and follow us on Twitter for updates all day long. Eli Lake is the senior national-security correspondent for Newsweek and the Daily Beast. He previously covered national security and intelligence for the Washington Times. Lake has also been a contributing editor at The New Republic since 2008 and covered diplomacy, intelligence, and the military for the late New York Sun. He has lived in Cairo, Egypt, and traveled to war zones in Sudan, Iraq, and Gaza. He is one of the few journalists to report from all three members of President Bush's axis of evil: Iraq, Iran, and North Korea. For inquiries, please contact The Daily Beast at editorial@thedailybeast.com. http://www.raytheon.com/capabilities/products/cybersecurity/insiderthreat/pr... Raytheon SureViewb" To protect an organizationbs most valuable non-corporeal assetbits information, it must monitor human behavior on the endpoint. Raytheon SureView is an appliance-based solution that monitors and enforces policies across all endpoints and channels of communication. Data collection is triggered when a violation occurs and it is stored for further investigation. In addition to securing some of the most critical Fortune 100 infrastructures, Raytheon set the information protection standard across the federal government, providing the highest levels of endpoint monitoring and focused observation across America's most critical classified networks. SureView is developed by a team of information protection domain experts who have spent their careers in information protection and have pioneered an active strategy to protect critical data by monitoring b technical observablesb which include not only databs location and movement but also the actions (including precursor actions) of users who access, alter, and transport that data. The SureView team has been a trusted mission partner of federal and commercial customers since 2001. The Visibility and Context You Need To Eliminate Insider Threats A wide range of insider threats can jeopardize your organization. Accidental data leaks are only one dimension; threats come in all shapes and sizes b from well-intentioned but inappropriate policy violations to deliberate theft of intellectual property or customer data. Finding them feels like finding a needle in a haystack. Where do you start? You need an information protection solution that monitors all activity without disrupting your business and easily distinguishes the good from the bad. SureView provides you with the context, evidence and answers that you need, even for mobile users off the corporate network. SureView is the only solution that lets you see policy violations on encrypted web traffic, e-mail and attachments. Only SureView monitors offline mobile laptops and detects threats usually hidden by encrypted traffic or files. The policy platform pulls it all together and displays all enterprise activity in an intuitive visual dashboard. SureView's DVR-like incident replay Full Event Reconstruction and Replay SureView monitors activity for policy violations. Once an incident is identified, data collection is triggered and stored for further investigation. SureView's unique replay feature plays back what the user was actually doing before, during and after the flagged incident to provide you with the context you need b was it accidental, reckless behavior or truly malicious behavior? Investigation through incident replay and inspection of all associated data helps quickly determine the root cause and implement the appropriate fix. Threats Begin at the Endpoint SureView provides visibility into the many areas network devices canbt, including: Deliberate, malicious acts such as IP theft, which easily circumvents most data leak solutions. Mobile and even internal users that b take themselves offlineb or use encryption to avoid detection. Complex problems: preventing export violations when intellectual property is inadvertently sent to the wrong countries. Suspicious activity within applications, including Lotus Notes and custom deployments of Enterprise Risk Management (ERM) and other internal applications. b Leading Indicatorb actions, such as a b screen captureb that has been encrypted and saved to a USB drive.