Catching the Next WikiLeaker

[Eugen Leitl]

http://www.thedailybeast.com/articles/2011/10/20/intelligence-community-tries-big-brother-software-to-catch-next-leaker.html

Catching the Next WikiLeaker

Oct 20, 2011 12:53 AM EDT

A year after the most expansive leak of classified information in U.S.
history, the intelligence community is deploying refined big-brother software
to monitor the spiesb lifeblood: their computer networks.

It is like a scene out of the television show 24. An intelligence officer is
surfing a top-secret government file that is out of his normal work
portfolio. A computer program alerts a bdata analyst,b who then monitors the
officerbs computer activity. If the officer acts like a potential leaker,
sending an encrypted email or using an unregistered thumb drive, the analyst
might push a button and watch a screen video of the officerbs last hour of
work. Once a case is made that a leak might be imminent, it is checkmate: the
agent is thwarted.

That is the kind of scenario Ryan Szedelo, the manager for Raytheonbs
SureView software, is describing this week for intelligence professionals in
San Antonio shopping for new gizmos at the annual GEOINT conference. The
government is already beginning to use the software and others like it in a
concerted effort to clamp down on secret leaks.

bSureView is designed to capture the next Bradley Manning,b Szedelo said of
the Army private who uploaded hundreds of thousands of classified documents
from the militarybs secret Internet protocol router network (SIPRnet) onto a
remote server affiliated with WikiLeaks.

With his secret clearance, Manning had access not only to the raw
intelligence reports in Iraq, but also to aircraft videos, analysis from the
field in Afghanistan, and candid diplomatic cables from U.S. embassies all
over the world.

bHad SureView been on Bradley Manningbs machine, no one would know who
Bradley Manning is today,b Szedelo said in an interview.

SureView is a type of auditing software that specializes in bbehavior-based
internal monitoring.b It is designed to identify and catch what is known in
the counterintelligence trade as the binsider threat,b a trusted user who is
willing to steal the secrets he or she is obliged to protect.

Until very recently, WikiLeaks had many leaders of the U.S. intelligence
community willing to pull back the kind of intelligence sharing started in
earnest after the Sept. 11, 2001, attacks. Last October, Director of National
Intelligence James Clapper said at a speech in Washington that bthe WikiLeaks
episode represents what I would consider a big yellow flag.b He added, bI
think it is going to have a very chilling effect on the need to share.b

wikileaks-security-lake

Protesters advocating the release of Bradley Manning on March 20, 2010, in
Quantico, Va., Evelyn Hockstein, The Washington Post / Getty Images

Today Clapper is taking a different tone. This week at GEOINT, the annual
trade show for the intelligence industry, Clapper said one of his top
priorities was to merge intelligence collection with intelligence analysis, a
process that by definition would require much more sharing among the 16 U.S.
intelligence agencies under his direction.

What has changed in the last year is the technology to catch the next big
leaker.

bThe trick is, can we allow robust sharing for analytical and operational
purposes and protect the information at the same time?b House Intelligence
Committee Chairman Mike Rogers (R-Mich.) said in an interview. bI argue yes,
there are lots of ways to do it.b

Rogers said he favors something called bsmart access,b where an intelligence
analyst not only would be monitored but would have to be cleared or
authenticated to enter specific servers outside his or her purview. bThese
are just trip wires. I prefer you have to knock on the door to get inbyou
should need to be authenticated to get into the next level.b 

The intelligence community has had auditing software for years. SureView came
on the market in 2002. But the programs were buggy and often prone to false
positives, alerting a network administrator too often to routine behavior. In
the last year, according to three U.S. intelligence officials who asked not
to be named, the software has become more automated and easier to apply to
larger databases.

bThe technology has gotten substantially better in the last year,b said
Jeffrey Harris, a former head of the National Reconnaissance Office, the
intelligence agency responsible for launching spy satellites. bThe problem
with audit files was it took an army of people to understand them. Now we
have rule-driven systems and expert systems that help us reason through the
data.b

Charles Allen, who served as the first intelligence chief for the Department
of Homeland Security, said the base where Manning was stationed in Iraq did
have auditing software in place that could have caught him, but it was not
yet implemented. bIn the future, military intelligence units in the war zones
and elsewhere will ensure there is a strong audit capability,b he said.

Allen has a point. Earlier this month, President Obama signed a new executive
order on protecting classified information. The order created a new binsider
threat task forceb inside the intelligence community, chaired by the attorney
general and the director of national intelligence.  

The new directive from the White House is driven in part by new technology.
The budget for this kind of counterintelligence software is still secret, but
judging from the trade-room floor, itbs a major draw for the U.S. government.
The Science Applications International Corporation (SAIC) is offering a
software system called Checkmate to detect external threats. A companion
product still in development for the internal threat is called Inmate.

    bHad SureView been on Bradley Manningbs machine, no one would know who
Bradley Manning is today.b

This kind of auditing software is one growth area in a new era of shrinking
intelligence budgets, Lynn Dugle, president of Raytheon Intelligence and
Information Systems, told The Daily Beast. bWe absolutely think there will be
growth in the insider threatbinternal monitoring market,b she said.

Trevor Timm, an activist for the Electronic Frontier Foundation who closely
watches the legal issues raised by WikiLeaks, said: bThe government has every
right to secure their own networks, but if they want to really stop leaks,
they need to stop classifying so much information that is not really secret.b
Timm added: bThe government classified a staggering 77 million documents last
year, a 40 percent increase on the year before. And a recent report to
Congress showed 4.2 million people have classified security clearances.
Thatbs more than the city of Los Angeles. As long as the government wonbt
address this underlying problem, people will always find ways to leak, no
matter the security.b

Like The Daily Beast on Facebook and follow us on Twitter for updates all day
long.

Eli Lake is the senior national-security correspondent for Newsweek and the
Daily Beast. He previously covered national security and intelligence for the
Washington Times. Lake has also been a contributing editor at The New
Republic since 2008 and covered diplomacy, intelligence, and the military for
the late New York Sun. He has lived in Cairo, Egypt, and traveled to war
zones in Sudan, Iraq, and Gaza. He is one of the few journalists to report
from all three members of President Bush's axis of evil: Iraq, Iran, and
North Korea.

For inquiries, please contact The Daily Beast at editorial at thedailybeast.com.

http://www.raytheon.com/capabilities/products/cybersecurity/insiderthreat/products/surview/index.html

Raytheon SureViewb"

To protect an organizationbs most valuable non-corporeal assetbits
information, it must monitor human behavior on the endpoint. Raytheon
SureView is an appliance-based solution that monitors and enforces policies
across all endpoints and channels of communication. Data collection is
triggered when a violation occurs and it is stored for further investigation.

In addition to securing some of the most critical Fortune 100
infrastructures, Raytheon set the information protection standard across the
federal government, providing the highest levels of endpoint monitoring and
focused observation across America's most critical classified networks.

SureView is developed by a team of information protection domain experts who
have spent their careers in information protection and have pioneered an
active strategy to protect critical data by monitoring btechnical
observablesb which include not only databs location and movement but also the
actions (including precursor actions) of users who access, alter, and
transport that data. The SureView team has been a trusted mission partner of
federal and commercial customers since 2001.  The Visibility and Context You
Need To Eliminate Insider Threats

A wide range of insider threats can jeopardize your organization. Accidental
data leaks are only one dimension; threats come in all shapes and sizes b
from well-intentioned but inappropriate policy violations to deliberate theft
of intellectual property or customer data.

Finding them feels like finding a needle in a haystack. Where do you start?
You need an information protection solution that monitors all activity
without disrupting your business and easily distinguishes the good from the
bad. SureView provides you with the context, evidence and answers that you
need, even for mobile users off the corporate network. SureView is the only
solution that lets you see policy violations on encrypted web traffic, e-mail
and attachments.

Only SureView monitors offline mobile laptops and detects threats usually
hidden by encrypted traffic or files. The policy platform pulls it all
together and displays all enterprise activity in an intuitive visual
dashboard.

SureView's DVR-like incident replay

Full Event Reconstruction and Replay

SureView monitors activity for policy violations. Once an incident is
identified, data collection is triggered and stored for further
investigation. SureView's unique replay feature plays back what the user was
actually doing before, during and after the flagged incident to provide you
with the context you need b was it accidental, reckless behavior or truly
malicious behavior? Investigation through incident replay and inspection of
all associated data helps quickly determine the root cause and implement the
appropriate fix.

Threats Begin at the Endpoint

SureView provides visibility into the many areas network devices canbt,
including:

    Deliberate, malicious acts such as IP theft, which easily circumvents
most data leak solutions.

    Mobile and even internal users that btake themselves offlineb or use
encryption to avoid detection.

    Complex problems: preventing export violations when intellectual property
is inadvertently sent to the wrong countries.

    Suspicious activity within applications, including Lotus Notes and custom
deployments of Enterprise Risk Management (ERM) and other internal
applications.

    bLeading Indicatorb actions, such as a bscreen captureb that has been
encrypted and saved to a USB drive.