Pentagon needs to guard against data breaches - Army Community - Army Discussions - Army Times

Pentagon needs to guard against data breaches

The most serious harm that has come from the WikiLeaks posting of classified war documents so far is the public release of information that could endanger Afghans who have worked with U.S. military forces.

That is serious, indeed, and the legal ramifications of that and related leaks are being sorted out. Pentagon authorities may pursue charges against WikiLeaks officials, just as the Army may do against the soldier suspected of leaking the classified material.

Such cases ultimately raise questions about how and why certain materials were classified, how they were controlled, whether release caused actual harm and even whether the public was better served by disclosure.

That’s highly unlikely when disclosure threatens the safety of U.S. forces and allies, or in some other way violates operational security. For those interests alone, defense officials need to do a far better job of protecting against unauthorized release of classified material.

That’s a huge task; according to a recent Washington Post report, more than 850,000 people have top-secret security clearances, including 265,000 contractors. A great many are involved in national security-related activities.

Defense Secretary Robert Gates indicated the military is taking steps to better guard against further breaches, but provided no details.

Experts cite some measures that could be put into practice right away:

• Disable CD burners and USB ports on network computers. The soldier suspected of providing classified material to WikiLeaks allegedly burned it onto CDs made to look like music discs and walked out of his workspace with them in hand.

Top-secret terminals should not contain CD drives, argues Steven Aftergood, head of the Federation of American Scientists’ Project on Government Secrecy.

Thumb drives were banned for a time by the Pentagon because they made unauthorized copying easy and because they often introduced viruses from one terminal to another. But there was a need for the convenience of thumb drives, so versions with security controls were developed and now are used.

Provisions similarly can be made for controlled use of CD burners and USB ports.

• Install automated monitoring systems to provide alerts whenever an unusually large or sensitive download of information is made, such as the software used by credit card companies to alert officials when an individual’s account shows unusual purchases.

Similarly, banks use “host data-loss prevention” software to prevent theft and accidental disclosure of customers’ account information. The software also enforces rules on how data is handled, from which employees can view it to whether it can be copied or transmitted.

• Use “watermark” digital documents with stamps that block unauthorized users and track how each document has been handled by approved users. The movie and recording industries use such technology.

The WikiLeaks disclosure of 91,000 secret documents — 15,000 of which have yet to be posted — is considered the largest in U.S. history.

It didn’t have to happen. The Defense Department and other U.S. agencies charged with keeping classified materials must take security measures to ensure it never does again.