Posted on 06/10/2013 12:10:36 PM PDT by nickcarraway
Of all the amazing, Le Carréan details surrounding the case of NSA leaker Edward Snowden, the one that seems to shock the most people is that all of this troubling, top-secret information was available to him, a 29-year-old high-school dropout who worked as a system administrator at private contractor Booz Allen Hamilton, and had little in the way of traditional accomplishment.
"He isn’t a seasoned FBI or CIA investigator," Slate's Farhad Manjoo wrote in a column that was typical of much of the sneering surrounding Snowden's credentials. "He isn’t a State Department analyst. He’s not an attorney with a specialty in national security or privacy law. Instead, he’s the IT guy, and not a very accomplished, experienced one at that."
But there is actually quite a bit of precedent for a case like Snowden's. To find it, you just have to look north from the NSA's headquarters, to Wall Street, where executives have known for years what intelligence officials are perhaps just realizing now: Back-office IT workers always know more than you think they do.
Consider the case of the rogue trader. These are bank employees who lose billions of dollars for their firms through unauthorized traders. As the Financial Times' John Gapper noted in his e-book, How to Be a Rogue Trader, most traders who have gone rogue got their training in the so-called "back-office" of a financial institution, where they learned the ins and outs of the firm's computerized trading systems — information they would later use to override the controls on those systems and avoid getting caught.
Two of the most famous rogue traders in history — Jérôme Kerviel at the French bank Société Générale and Kweku Adoboli at the Swiss bank UBS — both got their starts this way. Kerviel, who lost $6.4 billion for his bank and was sentenced to five years in prison as a result, began his career in the bank's compliance department, where he picked up the techniques necessary to bypass internal controls and evade detection once he moved over to the trading side. Adoboli, who lost $2.3 billion through unauthorized trading and was sentenced to seven years in prison, began his time at UBS in the bank's trade support division, where he learned some of the tricks that allowed him to conceal his trading risks later on.
Back-office workers aren't well respected or well paid within investment banks, but they can often outpace front-office workers when it comes to learning how the machinery works. As Gapper writes, "The back-office is a less glamorous and well-rewarded place than the trading floor — it has to ensure that everything runs smoothly and that the bank’s cash is accounted for. For Kerviel at Société Générale and Adoboli at UBS, it was useful training."
In fact, Wall Street banks have become so wary of the potential for harm on their trading desks that some have instituted a policy known as "block leave," a mandatory two-week vacation that is meant to afford supervisors a chance to sift through their employees' computer systems to look for traces of wrongdoing.
The tech world's equivalent of the back-office trade support worker is the "sysadmin," short for system administrator. The sysadmin rarely draws attention — you probably don't know the name of your company's sysadmin — but he or she knows everything and sees everything. The sysadmin is in charge of setting account permissions, creating and deleting accounts, and routing information to the correct people and places. If a corporation is a giant organism, the sysadmin is the cerebrum — the part that allows the rest to move. It's surprising that Edward Snowden used the information he collected about PRISM and other surveillance efforts — which he has said gave him "the authorities to wiretap anyone, from you or your accountant, to a federal judge or even the President" — to blow the whistle on his employer.
But it's not surprising at all that he had access to that information. After all, Snowden was a sysadmin. And like the sysadmins at every Wall Street bank and major corporation, Snowden knew and had access to much more than his title and level of expertise would indicate. If you're part of a large company, or even a small- or medium-size one, your employer has an Edward Snowden, too. And it's all you can do to hope they don't one day decide to go rogue.
We know a LOT more about you than you think. It actually boggles my mind how much personal data people store on our network storage. They think “it’s mine,” when in reality it’s company’s storage. They get pissed when we send them emails giving them 24 hours to remove the MP3s, MPGs, AVIs, WMVs, JPGs, GIFs, etc. from their “home” directories before we purge them.
Enterprise storage is NOT intended for your personal data backup, folks.
initial reports suggests this “rogue” IT guy, was blowing the whistle on a government bent on spying on everyone. EVERYONE. not just terrorist suspects.
the media is trying to paint him into a corner and make the administration out to be squeaky clean. even john bolton is against snowden... i am thinking i would vote for jury nullification in this case.
teeman
I once went into the IT inner sanctum at my company and the entire team, 10 of them, were gathered around a monitor watching porn. They were viewing what an employee was looking at in real-time. One of them told me they stored every mouse click we made. If there was a later issue, then they could go back and look at anything we’d ever done. (Presumably that was so the company could justify firing.)
Yet I knew employees who must have spent the better part of each day surfing the net and they never got fired, or even reprimanded. Memos went around about not doing it, but some people seemed to lead charmed lives.
$200 K/year for a gig in Hawaii ?
Do not anger happy fun BOFH.
In a well-run organization, this sort of thing is not allowed.
If a sysadmin needs to make a change that requires root access, he needs a valid approved change number, where the exact change to be made is documented. He enters that number into a password control system, and draws the root password. That password is only good for the time period specified in the change control.
Does the cost of living put him right above the poverty line?
Our compliance dept would freak if they really knew what we could do and see. Speaking of cleaning up your network storage... You ever run an SCCM collection for all *.mp3, *.jpg etc. on everyone’s machine?
I once watched an entire storage array and all the backup tapes disappear into an unmarked truck never to be seen again. Turns out one of the managers was using his space on the storage array to store, and distribute via company email, gazoodles of kiddie porn.
Feds took everything. Ev. Ree. Thing.
I can GUARANTEE the mid level Sr. Manager/Deputy Pgm. mgr that hired this guy is gone.
I’ve heard Hawaii living is high dollar. Nearly all food is imported.
We visited three years ago and saw a small tanker waiting to load gasoline from one of the refineries, destined for the big island.
It is possible that Edward Snowden was being groomed to play such a role for the NSA and decided to bail out first.
We wrote a compliance policy that stated that any and all files related to music, movies, or copyrighted material would be deleted without question or reason. Some of the call center folks thought they were smart renaming those files with different extensions. Little did they realize that our scanning suite checked the actual file headers. The angry calls came in for about a week until management got wind of the volume of calls, at which point they sent out an email stating that anyone storing copyrighted materials on the SAN or NFS would be terminated without question. We never heard another peer from the user community.
Holy crap that’s a strict policy.
What happened when you did?
I’m not sure you should make that bet.
It would bog down the network collecting everyone’s personal media files lol.
I would assume/hope that if you're working with top secret data, that other methods are in place to insure that you're still one of the "good guys" (periodic reviews of your clearance status, etc.).
We’re not as strict, but EPO blocks access to all unapproved removable media in our policy. We limit the amount of internet access people have, but even so we still wind up with gigs of useless media sitting around. The worst offenders are the people who are approved.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.