FTP connection activity is logged in syslog or similar. Auditing is configured to record complete ftp transactions. The following is auditable information for each event. Date and time. File or program name that is accessed.
Logfile analysis is automated and accomplished daily.
Reports of anomalous activity are sent automatically to the system administrator. All accounts are authenticated. Traffic is encrypted. Transactions analysis to detect contacts with foreign countries is done daily and automatically. Suspicious foreign connections are reported to the local NCIS supervisory agent.