NSA, Army Breach Exposed 100GB of Highly Classified Data
Tags: Security, Infosec, Surveillance, Nsa, Defense

by Joel Hruska

Of all the various branches of government, none rely on trust more than intelligence agencies. The military scarcely makes a habit of broadcasting its troop movements or deployments on the front page of the newspaper. But Congress — a civilian government — has the power to call various military leaders to testify and to investigate reports of malfeasance.

The intelligence agencies of the United States, on the other hand, work in a shadowed world. Their intelligence operations are often approved in the FISA Court rather than by a normal federal judge. And they have been granted enormous power to gather data on individuals both within and outside America, all in the name of making and keeping America a safer place. Most citizens accept that this secrecy is justified and logical in at least some circumstances, but it’d be easier to extend that conclusion if we didn’t keep seeing stories of such bungling incompetence as to beggar belief.

UpGuard reports that its own investigations of the Army Intelligence and Security Command (INSCOM, a joint project of the Army and the NSA) found 100GB of data sitting in a publicly accessible Amazon S3 cloud storage bucket where literally anyone could access it. They write:

Among the most compelling downloadable assets revealed from within the exposed bucket is a virtual hard drive used for communications within secure federal IT environments, which, when opened, reveals classified data labeled NOFORN — a restriction indicating a high level of sensitivity, prohibited from being disseminated even to foreign allies. The exposed data also reveals sensitive details concerning the Defense Department’s battlefield intelligence platform, the Distributed Common Ground System — Army (DCGS-A) as well as the platform’s troubled cloud auxiliary, codenamed “Red Disk.”

Much of the data found on the Oracle Virtual Appliance could not be accessed without connecting to the Pentagon, but that’s not an excuse for the security lapse. Stored files included some marked Top Secret and others labeled as NOFORN, which means the data is so sensitive, it could not be shared, even with America’s foreign allies. UpGuard also found private keys for accessing distributed intelligence systems that belong to Invertix (a company known to have done work for INSCOM before), as well as hashed passwords that might yield further clues or access if cracked.

Screenshot by UpGuard

The problem is, this isn’t the first, or even third time this has happened recently. As UpGuard states: “Given how simple the immediate solution to such an ill-conceived configuration is — simply updated the S3 bucket’s permission settings to only allow authorized administrators access — the real question is, how can government agencies keep track of all their data and ensure they are correctly configured and secured?”

To that, we’d add the following: How can you be reasonably asked to trust the conclusions of intelligence agencies who literally can’t be bothered to enact basic security measures to ensure their data isn’t tampered with or insecure? NOFORN is a serious security rating. Anything so stamped should have been secured at the very highest level.

Now read: 20 Best Tips to Stay Anonymous and Protect Your Online Privacy