Message from only working ongoing cases, but constantly 

Joseph S. doing our best to maximize our Agency 

Mahaley, workforce awareness of today’s increasingly 

challenging CI/CT threats. It also means NASA Assistant doing our best to understand our colleagues’ Administrator work and how it interacts with and impacts 

for Protective our NASA-wide CI/CT program. This is cruServices cial if we’re going to maximize our CI/CT 

program’s overall effectiveness. It’s a great pleasure and an honor for me 

to join NASA’s incredibly talented team, Maximizing our CI/CT effectiveness is 

including our counterintelligence/coun- more important today than it’s ever been. 

terterrorism (CI/CT) professionals. In the Each Center has an Office of Protective Sershort time that I’ve been here, I’ve already vices (OPS) CI/CT office, and I encourage 

become well aware of the significant accom- all of you to get to know the agents assigned 

plishments and positive impact the counter- to your Center office. All CI/CT offices are 

intelligence effort has had on the protection prepared to provide you with current threat 

of NASA’s people, information, facilities, analysis and are also prepared to brief and 

and operations every day. prepare you for overseas travel threats. 

Today, NASA, as well as other Federal The protection of NASA’s workforce from 

agencies, continues to operate in a very chal- foreign intelligence and terrorist activity is 

lenging environment. The foreign intelligence everyone’s responsibility. The NASA CI/CT 

and security service threats against NASA are program is only a part of the total effort we 

real, multidimensional, and growing. We must all must make to ensure we keep NASA 

address and confront these threats with our protected from the dangerous threats of

best efforts, every single day. That means not espionage and terrorism. 

Informational Newsletter on Counterintelligence and Counterterrorism Issues Affecting NASA

Continued on next page

www.nasa.gov A publication of the Office of Protective Services, Counterintelligence Division

Office of Protective Services

Assistant Administrator 

Joseph S. Mahaley 

202-358-3752

Counterintelligence/ 

Counterterrorism Division

Director 

Operations

Arthur Payton 

Administrative Assistant 

Counterintelligence Quote

“Foreign attempts to collect U.S. technological and economic information 

by cyber espionage will continue at a 

high level in 2012 and will represent a 

growing and persistent threat to U.S. 

economic security.”

—Antone Gonsalves, InformationWeek

Traveling Light in a Time of Digital Thievery

Adapted from an article published in the New York Times on February 10, 2012, by Nicole Perlroth. 

The full article is available at http://www.nytimes.com/2012/02/11/technology/electronic-security-a-worryin-an-age-of-digital-espionage.html?pagewanted=all.

When U.S. Government aerospace employee Bud Stemple travels to certain sensitive foreign destinations that are known to aggressively monitor visiting information technology (IT) 

devices, he follows a routine that seems straight from a spy film. He leaves his cell phone and 

laptop at home and instead brings “loaner” devices, which he erases before he leaves the U.S. 

and wipes clean the minute he returns. For instance, when he travels to China, he disables 

Bluetooth and wireless fidelity (WiFi), never lets his phone out of his sight, and, in meetings, 

surviellence

National Aeronautics and 

Space Administration

Summer 2012

(b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C)

(b) (7)(E)
Informational Newsletter on Counterintelligence and Counterterrorism Issues Affecting NASA

Summer 2012

works if you can. In some countries, hard to detect. Read more in “Foreign Spies 

networks are controlled by security Stealing U.S. Economic Secrets in Cybernd in all cases they are not secure. space—October 2011 Report to Congress on 

Spy software, which intercepts and transmits Foreign Economic Collection and Industrial The practice of distributing malware through information without a user’s knowledge, Espionage, 2009–2011” at http://www.dni. hotel chains’ Internet connections is a domes- can be implanted in both wired and wireless gov/reports/20111103_report_fecie.pdf. tic and international problem. A software Internet portals in cafes, hotels, transportation engineer staying at a Marriott International depots, and elsewhere. Once installed, mali- hotel in the U.S. noticed that code was being cious software can be used to further com- NASA Center CI Offices

injected into Web sites via the hotel WiFi promise computer systems and networks. connections for the purpose of pushing third- Use up-to-date protections for antivirus, spy- party advertisements to users. Marriott Inter- Ames Research Center

ware, security patches, and firewalls. Sanitize national released an official statement that your laptops prior to travel and ensure no this was done “unbeknownst to the hotel.” In sensitive contact, research, or personal data this situation, the advertisements were harm- is on them. Backup all information you take Dryden Flight Research Center

less; however, this cannot be reassuring to and leave that at home. If feasible, use a new 

guests of the Marriott International—that the e-mail account while traveling. hotel chain did not know what was going on

in their own network. Clear your browser after each use by doing 

Glenn Research Center

the following: delete history files, caches, You don’t have to leave the country or stay cookies, and temporary Internet files. In most in a hotel to have your computer hacked by a countries, you have no expectation of privacy Goddard Space Flight Center

foreign entity. Firms that have been compro- in Internet cafes, hotels, airplanes, offices, mised in this type of attack are believed to or public spaces. If information might be include Research in Motion Ltd. and Boston valuable to another government, company, Scientific Corporation, as well as some of or group, you should assume that it will be Jet Propulsion Laboratory

the largest corporations and niche innovators intercepted and retained. Change all your in sectors such as aerospace, semiconduc- passwords, including your voicemail’s, and 

tors, pharmaceuticals, and biotechnology. check your devices for malware when you Johnson Space Center 

By hacking into these companies hackers return before communicating with home net- may have had access to millions of confiden- works and especially before connecting to tial e-mails, even encrypted ones, and com- NASA networks.

pany information. Kennedy Space Center

NASA Counterintelligence Perspective

2011 Congressional Report 

The best advice for NASA foreign travelers Langley Research Center on Cyberspace Espionage is to not perform any updates over a public, 

untrusted network. In fact, if you are travel- Foreign economic collection and industrial

ing with any sensitive data or with a com- espionage against the U.S. represent sigputer that later will be connected to a net- nificant and growing threats to the Nation’s Marshall Space Flight Center

work with sensitive data, it makes sense to prosperity and security. Cyberspace—where 

do as little as possible online. The idea is to most business activity and development of

take nothing along that you cannot afford to new ideas now take place—amplifies these Stennis Space Center

lose—including data. threats by making it possible for malicious 

actors, whether they are corrupted insidNASA civil servants and contractors are ers or foreign intelligence services (FIS),

encouraged to not initiate updates that pop up to quickly steal and transfer massive quanti- CI homepage website 

while using a hotel’s WiFi connection. Avoid ties of data while remaining anonymous and 

A publication of the Office of Protective Services, Counterintelligence Division

the iBAHN broadband and entertainment WiFi net

service offered to guests of hotel chains such wireless 

as Marriott International, Inc. services a

(b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (7)(E)
Summer 2012

Informational Newsletter on Counterintelligence and Counterterrorism Issues Affecting NASA

“The Chinese are very good at covering IT equipment should not be left unattended Foreign Travel Alert: 

their tracks,” said a former FBI or visible in the vehicle. These tips are for Beware of Malware Installed 

agent who specialized in counterintelligence the safety and security of your equipment via Hotel Networks

and computer intrusion. “In most cases, and will help guard against theft and from 

companies don’t realize they’ve been burned having malicious software downloaded The Federal Bureau of Investigation (FBI), 

until years later when a foreign competi- onto your devices, which could extract through the Internet Crime Complaint 

tor puts out their very same product—only information or install a virus, infecting the Center (ISC3), has issued a warning that 

they’re making it 30 percent cheaper.” NASA network. “malicious actors are targeting travelers 

abroad through pop-up windows while 

“We’ve already lost our manufacturing NPD 2540.1G establishing an Internet connection in their

base,” he said. “Now we’re losing our R&D hotel rooms.” 

[research and development] base. If we lose (1) Domestic Travel—When IT and/

that, what do we fall back on?” or computer equipment is taken out of According to FBI findings, there has been 

the workplace (i.e., telework, offsite an increase in instances of travelers’ noteNASA Counterintelligence business meetings, and conferences), books being infected with malicious software 

Perspective it is the responsibility of the employee when connected to hotel Internet networks. 

to ensure that the equipment remains It is thought that the method of infecting the NASA employees have legal obligations to in their custody, is handled and main- notebooks occurs while users attempt to set protect U.S. sensitive information and tech- tained properly, and is returned in good up Internet connections in their rooms. Some nologies from being compromised. NASA condition. In the event that the equip- users have been presented with a pop-up employees are not immune to foreign intel- ment is lost, stolen, or damaged, the window that notifies users of an update from ligence cyberthreats while on travel. The tar- employee shall notify the NASA Enter- a widely used software product/company. geting of NASA IT devices is low-cost and prise Help Desk or NASA Security When the users accept the update, malicious low-threat to perpetrators, and it’s proven to Operations Center as soon as possible software is installed on their notebooks.

yield high payoffs. Perpetrators are known after the occurrence of an incident.

to target both personal and professional The FBI’s Internet Crime Complaint Center

IT devices that are in a NASA employee’s (2) International Travel—The employee has issued the following good advice 

possession for personally identifiable infor- shall use only equipment officially for travelers:

mation, NASA intellectual property and approved for use outside of the U.S. for 

trade secrets, and any information related international business meetings, con- • Carry out all software updates before 

to developing/game-changing NASA tech- ferences, symposia, etc. The employee traveling.

nologies to advance their own economies or must ensure that the hardware remains • Check the author or digital certificate aerospace industries and endanger U.S. tech- in his or her possession while outside of any prompted update to see if it nological advantages at a global level. the U.S. Any loss, damage, or tamper- corresponds to the software vendor. ing shall be reported immediately/at NASA civil servants and contractors who the earliest opportunity to the Center • Download software updates directly require the use of NASA-owned com- CIO. Under no circumstances should from the vendor’s Web site.

puter equipment while on foreign travel Agency laptops or personal computers are required to adhere to the guidelines in be used for official business on interna- In addition to these helpful tips, it is recomNPD 2540.1G. The NASA Policy Direc- tional trips unless written authorization mended that all important information—

tive (NPD) states it is the responsibility is first obtained from the Center CIO. including, but not limited to—e-mails, 

of the NASA civil servant or contractor to documents, instant messages (IMs), and Web 

keep possession of NASA equipment at all NASA counterintelligence strongly logins should be sent over a secure Hypertext 

times while on travel. When traveling by recommends that NASA civil servants Transfer Protocol (HTTP) or a virtual private 

plane, it directs that all NASA IT equip- and contractors traveling abroad coor- network (VPN). This FBI advisory follows a 

ment must remain with you as a carry on— dinate with their NASA IT Loaner report from Bloomberg news which claims 

never check your laptop with your luggage. Pool Program in advance to obtain that Chinese hackers have stolen private data 

Never let a laptop out of your sight in an loaner equipment such as laptops and from as many as 760 firms by hacking into 

airport. When traveling by vehicle, NASA smartphones for use while on travel. Continued on next page

A publication of the Office of Protective Services, Counterintelligence Division

(b) (6)
A publication of the Office of Protective Services, Counterintelligence Division

Summer 2012

Informational Newsletter on Counterintelligence and Counterterrorism Issues Affecting NASA

NASA Center CI Offices

Ames Research Center

Dryden Flight Research Center

Glenn Research Center

Goddard Space Flight Center

Jet Propulsion Laboratory

Johnson Space Center

Kennedy Space Center

Langley Research Center

Marshall Space Flight Center

Stennis Space Center

CI homepage website

the iBAHN broadband and entertainment 

service offered to guests of hotel chains such 

as Marriott International, Inc.

The practice of distributing malware through 

hotel chains’ Internet connections is a domestic and international problem. A software 

engineer staying at a Marriott International 

hotel in the U.S. noticed that code was being 

injected into Web sites via the hotel WiFi 

connections for the purpose of pushing thirdparty advertisements to users. Marriott International released an official statement that 

this was done “unbeknownst to the hotel.” In 

this situation, the advertisements were harmless; however, this cannot be reassuring to 

guests of the Marriott International—that the 

hotel chain did not know what was going on 

in their own network. 

You don’t have to leave the country or stay 

in a hotel to have your computer hacked by a 

foreign entity. Firms that have been compromised in this type of attack are believed to 

include Research in Motion Ltd. and Boston 

Scientific Corporation, as well as some of 

the largest corporations and niche innovators 

in sectors such as aerospace, semiconductors, pharmaceuticals, and biotechnology. 

By hacking into these companies hackers 

may have had access to millions of confidential e-mails, even encrypted ones, and company information. 

NASA Counterintelligence Perspective

The best advice for NASA foreign travelers 

is to not perform any updates over a public, 

untrusted network. In fact, if you are traveling with any sensitive data or with a computer that later will be connected to a network with sensitive data, it makes sense to 

do as little as possible online. The idea is to 

take nothing along that you cannot afford to 

lose—including data. 

NASA civil servants and contractors are 

encouraged to not initiate updates that pop up 

while using a hotel’s WiFi connection. Avoid 

WiFi networks if you can. In some countries, 

wireless networks are controlled by security 

services and in all cases they are not secure. 

Spy software, which intercepts and transmits 

information without a user’s knowledge, 

can be implanted in both wired and wireless 

Internet portals in cafes, hotels, transportation 

depots, and elsewhere. Once installed, malicious software can be used to further compromise computer systems and networks. 

Use up-to-date protections for antivirus, spyware, security patches, and firewalls. Sanitize 

your laptops prior to travel and ensure no 

sensitive contact, research, or personal data 

is on them. Backup all information you take 

and leave that at home. If feasible, use a new 

e-mail account while traveling. 

Clear your browser after each use by doing 

the following: delete history files, caches, 

cookies, and temporary Internet files. In most 

countries, you have no expectation of privacy 

in Internet cafes, hotels, airplanes, offices, 

or public spaces. If information might be 

valuable to another government, company, 

or group, you should assume that it will be 

intercepted and retained. Change all your 

passwords, including your voicemail’s, and 

check your devices for malware when you 

return before communicating with home networks and especially before connecting to 

NASA networks.

2011 Congressional Report 

on Cyberspace Espionage

Foreign economic collection and industrial 

espionage against the U.S. represent significant and growing threats to the Nation’s 

prosperity and security. Cyberspace—where 

most business activity and development of 

new ideas now take place—amplifies these 

threats by making it possible for malicious 

actors, whether they are corrupted insiders or foreign intelligence services (FIS), 

to quickly steal and transfer massive quantities of data while remaining anonymous and 

hard to detect. Read more in “Foreign Spies 

Stealing U.S. Economic Secrets in Cyberspace—October 2011 Report to Congress on 

Foreign Economic Collection and Industrial 

Espionage, 2009–2011” at http://www.dni.

gov/reports/20111103_report_fecie.pdf.

(b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)(C) (b) (6), (b) (7)

(C)

(b) (7)(E)