Pentagon on drone threat to nuclear sites, then Hillary

Posted on September 27, 2016September 27, 2016 by Denise Simon

Stripes: MINOT AIR FORCE BASE, North Dakota— Throughout the agricultural fields that dominate North Dakota,150 Minuteman III nuclear intercontinental ballistic missiles are encased in silos in the ground.

Each silo contains one missile, dug into deep holes on private farmlands, three to 10 miles apart. From the air, the silos are hard to detect.

But the positions are in the open, except for an antenna and some fencing, so the sites are often approached by animals or non-threatening drones, said Col. Jason Beers, commander of the 91st Security Forces command at the base.

“There are a lot of [unmanned aerial vehicles] with commercial farming,” he said.

The base hasn’t had a security issue with drones at the silos, though there isn’t a lot they can do if they did, Beers said.

“It’s not restricted airspace,” he said.

The proliferation of drones in the United States and the potential security threat that they pose to the nuclear facilities, nuclear weapons storage areas and military installations has gained the attention of the Pentagon and Congress, a defense official told Stars and Stripes on the condition of anonymity.

“It’s certainly got more attention as it has become more common among our adversaries,” the official said. “Even [the Islamic State group] has played with UAVs.”

The Defense Advanced Research Projects Agency is developing potential defenses against an intruding drone, as are several private companies. The challenge is many of the methods that could be used to defend against a drone – whether shooting it down or disabling it with a laser or electronic or radio interference – could also harm nearby infrastructure or other aircraft.

But the Pentagon will also need the authority to contain or shoot down drones near the silos. Gaining the authorities and creating policy to defend silos against drones is a concern of Gen. Robin Rand, commander of Air Force Global Strike Command.

At the Air Force’s annual convention last week, Rand told reporters the proliferation of drones has the service working on options to best to protect the missile silos, bombers and weapons storage facilities under his care.

“I will tell you there have been recent examples of extended [UAVs] over some areas that we don’t particularly like them to be on — I’m not comfortable with that,” he said.

But the policy to deal with it has to come from multiple agencies that have jurisdiction, including the Federal Aviation Administration, the Department of Homeland Security, the Department of Defense and others, Rand said.

“It’s not just something where I can tell the guys to go out and take a shotgun and point it up and shoot down something flying over,” he said. “We as a nation need to deal with this potential emerging threat.”

Rep. Mike Rogers, R-Alabama, introduced legislation in this year’s National Defense Authorization Act to require the Department of Defense and the Department of Energy, which is responsible for securing the nation’s nuclear material and weapons and energy programs, to get started on a solution.

“Some of my colleagues and I have been tracking how these systems could pose a threat to national security. [UAV] incursions and unauthorized overflights of critical defense facilities continue to increase — and, unfortunately, the laws and regulations governing these things haven’t kept up,” Rogers said.

The bill passed the House, but is still being negotiated in the Senate.

“We have to face the fact that yes, the possibility exists” that a UAV could be used to attack a U.S. nuclear facility, Rand said. “We need to be able to deal with it.”

****

Then there is Hillary:

Clinton Privately Opposed Major U.S. Nuclear Upgrade

Dem nominee breaks with key Obama defense policy in previously unreleased recording

FreeBeacon: Hillary Clinton privately told supporters this year that she would likely scrap a major upgrade to the United States’ nuclear weapons program, according to leaked audio of her remarks.

At a private event in McLean, Va., in February, Clinton revealed that she would likely cancel plans to upgrade the nation’s cruise missile arsenal. “I certainly would be inclined to do that,” she told a questioner who asked about rolling back the Long Range Stand-Off (LRSO) missile program.

Audio of Clinton’s comments at a gathering of major campaign supporters in February were revealed by hackers who breached the email account of a campaign staffer. One email released by the hackers contained a recording of Clinton’s remarks and a subsequent question-and-answer session.

The LRSO question came from Andy Weber, a former assistant secretary of defense who oversaw the Pentagon’s nuclear weapons programs. He and William Perry, who served as secretary of defense under President Bill Clinton, called for the cancellation of the LRSO program last year.

“Will you cancel this program if President Obama doesn’t in the next 11 months and lead the world in a ban on this particularly destabilizing, dangerous type of nuclear weapon?” Weber asked at around 39:00 in the recording.

Clinton said she would be “inclined” to do so. “The last thing we need are sophisticated cruise missiles that are nuclear armed,” she said.

Her campaign did not respond when asked if her position has changed since then.

Canceling the LRSO program would be a major break from Obama administration policy, which has placed significant emphasis on the missile as a key component of its wide-ranging efforts to modernize the U.S. nuclear arsenal.

About 1,000 LRSO missiles are scheduled to replace the Air Force’s Air-Launched Cruise Missiles (ALCMs) by 2030. The ALCM program has formed a key component of U.S. nuclear deterrence policy since the early 1980s.

The Air Force released long-awaited requests for proposals from defense contractors in July. It estimated that the government will pay $17 billion for a new arsenal of LRSO missiles, though critics have pegged the cost at as much as $30 billion.

Emails released by the State Department in response to Freedom of Information Act requests show that Clinton was briefed on aspects of the LRSO debate while serving as secretary of state.

After a November 2010 meeting between high-level Pentagon officials and former Sen. Jon Kyl (R., Ariz.), then the Senate’s third-ranking Republican, the State Department’s top legislative affairs official informed Clinton and top aides Cheryl Mills and Huma Abedin that the administration was “committed to LRSO.”

Clinton has appeared unfamiliar with details of the Obama administration’s plans for nuclear weapons modernization in statements since then. Clinton avoided a straight answer when asked about those plans at a campaign event in January, but expressed skepticism.

“Do you oppose plans to spend a trillion dollars on an entire new generation of nuclear weapons systems that will enrich the military contractors and set off a new global arms race?” she was asked.

Clinton responded, “Yeah I’ve heard about that. I’m going to look into that. That doesn’t make sense to me.”

Former Air Force launch officer John Noonan disagreed with Clinton’s opposition to the LRSO program and other aspects of the Obama administration’s nuclear modernization efforts. But he is skeptical that Clinton will actually follow through on that opposition.

“There’s been tremendous advancements in Russian and Chinese cruise missiles, coupled with an atrophy in American capability,” noted Noonan, a former Jeb Bush campaign aide critical of both Clinton and Republican presidential nominee Donald Trump.

“The Obama Administration, to their credit, has acknowledged this and have budgeted for the LRSO,” he said. “A President Clinton’s Pentagon will be faced with the same tough reality.”

As for Clinton’s remarks to Weber in February, Noonan guessed that she was “just petting a donor on the head and telling him he’s pretty.”

APT 28: Russian Cyber Attacks Britain and Germany as Well as U.S.

Posted on September 26, 2016September 26, 2016 by Denise Simon

APT 28:

TechTimes: FireEye said in a white paper they released in 2014 that APT 28 had launched attacks against military and political organizations beginning in 2007. Other targets that the Kremlin have special interest in include the NATO alliance offices and government officials in Georgia. In these attacks, the group had reportedly gathered “malware samples with Russian language settings during working hours consistent with the time zone of Russia’s major cities, including Moscow and St. Petersburg.”

The APT 28 used the same tools and hit the same targets performed by the Pawn Storm hackers that were described by security firm Trend Micro in a separate report. According to the company, the Pawn Storm hacking group recently increased their activity and targeted bloggers who conducted interviews with President Barack Obama. There is also speculation that the group had stolen online credentials of a military correspondent of an unnamed major publication in the U.S. More here.

RUSSIA’S HACKERS HIT BRITAIN

Putin’s cyber warriors the Fancy Bears targeted government websites and the BBC in the run-in to last year’s election

Defensive measures deployed to thwart the attack by Fancy Bears after it was discovered by spy agency GCHQ

TheSun: A RUSSIAN cyber attack on British government departments and TV broadcasters in the run-up to last year’s general election was thwarted by intelligence agencies, it emerged today.

GCHQ boffins halted the “imminent threat” by Kremlin-backed hackers Fancy Bears – the group behind the leak of Olympic athletes’ doping files.

Russian hackers targeted government departments and broadcasters including the BBC in the run-up to the 2015 general election.

***

The revelation of the attack on the British election comes amid concerns Russian hackers are attempting to disrupt the US presidential race.Last week another Russian group, DC Leaks, hacked White House servers to obtain what appeared to be Michelle Obama’s passport.

Fancy Bears planned to attack every Whitehall server including the Home Office, Foreign Office and Ministry of Defence, security officials told the Sunday Times.

They were also targeting all the main UK broadcasters including the BBC, ITV, Channel 4 and Sky.

Getty Image: An attack on France’s TV5Monde network claimed on behalf od ISIS by the ‘Cyber-Caliphate’ was traced to the Fancy Bears in Moscow

***

The GCHQ eavesdropping agency uncovered the threat after probing the group’s successful attack against TV5Monde, one of France’s biggest TV networks, in April last year.

It was feared ISIS had reached new levels in its ability to wage cyber war after all 11 of the French broadcasters channels were take off air and its website was flooded with jihadist propaganda.

But GCHQ traced the hack – claimed by a group calling themselves the “Cyber-Caliphate” – back to Moscow and then uncovered they were planning to hit Britain next.

Analysts feared that the Putin-sponsored group could “embarrass” pillars of the British state and took defensive measures to protect government departments.

Senior security officials are also understood to have warned the TV networks so they could defend themselves.

One security official said: “We had information, and it could have been activated, which is why it was an imminent threat.

“They certainly could have defaced a website for propaganda reasons and they could have possibly taken it down.”

It is the first known threat by the Kremlin-backed hackers to interfere in the British political process.

News of the attack comes after Fancy Bears published details of athletes including Mo Farah and Sir Bradley Wiggins hacked from the global anti-doping watchdog Wada.

Papers revealed they were given medical exemption certificates to use banned drugs.

AP:Associated Press: The Fancy Bears leaked confidential medical filed on dozens of Olympic athletes after hacking the anti-doping body Wada

***

In July the hackers were blamed for the leak of 20,000 damaging emails from the US Democratic National Committee – just as it was about to confirm Hillary Clinton as presidential candidate.

The intervention was seen a Moscow’s attempt to boost Donald Trump’s chances in the election.

The group is thought to be behind a shutdown of the national grid in Ukraine and attacks on the governments of Syria, Uzbekistan, Pakistan and the United Arab Emirates.

Fancy Bears also targeted the BBC, The Guardian, Al Jazeera, Reuters, CNN, Farnborough arms fair, defence contractor Northrop Grumman, one cyber security report says.

Separately a list published by security experts at the PwC consultancy shows 245 apparent Fancy Bears attacks on targets including Nato, the Chilean military, Apple, Google, the German ministry of defence and the Polish and Hungarian governments.

There is no suggestion any of these has been successful although one firm on the list, Yahoo, last week admitted the personal information of 500million users had been stolen by what it called “state-sponsored” hackers in late 2014.

****

BroadbandTVNews: The BBC, ITV, Channel 4 and Sky were involved in what David Anderson QC, the independent reviewer of terrorism legislation, described the incident as a “possible imminent threat” to the UK. The Sunday Times reports that Anderson said the government’s monitoring agency GCHQ “deployed a capability to protect government networks from this cyber-attacker”.

The information was revealed in a previously unnoticed report released in July. Broadcasters were warned of the potential threat and advised to take action.

British security officials have told the paper the group plotting the attack was Fancy Bears, also known as APT28 and Sofacy, the same group that last April brought down the French international broadcaster TV5 Monde.

Within a few seconds of the April 8th attack, all of TV5’s channels stopped broadcasting, and it also lost control of its sites and social profiles. On screen messages declared allegiance to ISIS.

Cold War Part 2: Spy Networks and Cyber Warfare

Posted on September 23, 2016September 23, 2016 by Denise Simon

Adding more spies and operatives…seems to be a global trend and not lost on Russia.

FP: Russian President Vladimir Putin, according to Kommersant, is planning a major overhaul of the country’s security services. The Russian daily reported that the idea of the reforms is to merge the Foreign Intelligence Service, or SVR, with the Federal Security Service, or FSB, which keeps an eye on domestic affairs. This new supersized secret service will be given a new name: the Ministry of State Security. If that sounds familiar, it should — this was the name given to the most powerful and feared of Joseph Stalin’s secret services, from 1943 to 1953. And if its combination of foreign espionage and domestic surveillance looks familiar, well, it should: In all but name, we are seeing a resurrection of the Committee for State Security — otherwise known as the KGB.

The KGB, it should be remembered, was not a traditional security service in the Western sense — that is, an agency charged with protecting the interests of a country and its citizens. Its primary task was protecting the regime. Its activities included hunting down spies and dissidents and supervising media, sports, and even the church. It ran operations both inside and outside the country, but in both spheres the main task was always to protect the interests of whoever currently resided in the Kremlin. With this new agency, we’re seeing a return to form — one that’s been a long time in the making.

There was a time, not so long ago, when Russian leaders sought to create a depoliticized security structure. When the Soviet Union collapsed in 1991, the reform of the KGB became an immediate, pressing issue. The agency was not reliably under control: The chairman of the KGB at the time, Vladimir Kryuchkov, had helped mastermind the military coup attempt aimed at overthrowing Mikhail Gorbachev that August. But new President Boris Yeltsin had no clear ideas about just how he wanted to reform the KGB, so he simply decided to break it into pieces.

The largest department of the KGB — initially called the Ministry of Security; then, later, the Federal Counterintelligence Service (FSK); then, even later, the FSB — was given responsibility solely for counter-espionage and counterterrorism operations. The KGB’s former foreign intelligence directorate was transformed into a new agency called the Foreign Intelligence Service, or SVR. The division of the KGB responsible for electronic eavesdropping and cryptography became the Federal Agency of Government Communications and Information, or FAPSI. A relatively obscure directorate of the KGB that guarded secret underground facilities continued its functions under a new name: the Main Directorate of Special Programs of the President, or GUSP. The KGB branch that had been responsible for protecting Soviet leaders was renamed the Federal Protective Service, or FSO, and the Soviet border guards were transformed into an independent Federal Border Service, or FPS.

The main successor of the KGB amid this alphabet soup of changes was the FSK. But this new counterintelligence agency was stripped of its predecessor’s overseas intelligence functions. The agency no longer protected Russian leaders and was deprived of its secret bunkers, which fell under the president’s direct authority. It maintained only a nominal presence in the army. In its new incarnation, the agency’s mission was pruned back to something resembling Britain’s MI5: to fight terrorism and corruption. More here from FP.

Related reading: ‘Cyber Cold War’ rhetoric raises alarms

What is the United States doing?

IN 2015, as China and Russia boost their military presence in the resource-rich far north, U.S. intelligence agencies are scrambling to study potential threats in the Arctic for the first time since the Cold War, a sign of the region’s growing strategic importance.

Over the last 14 months, most of the 16 U.S. intelligence agencies have assigned analysts to work full time on the Arctic. The Office of the Director of National Intelligence recently convened a “strategy board” to bring the analysts together to share their findings.

In addition to relying on U.S. spy satellites orbiting overhead and Navy sensors deep in the frigid waters, the analysts process raw intelligence from a recently overhauled Canadian listening post near the North Pole and a Norwegian surveillance ship called the Marjata, which is now being upgraded at a U.S. Navy shipyard in southern Virginia.

**** And we are playing catch up in Washington DC and in key locations around the globe when it comes to Russia. Adding more technology is great and it does have value but not like that of having human intelligence in theater.

**** Decades After Cold War’s End, U.S.-Russia Espionage Rivalry Evolves

So what does Britain’s MI6 have to say?

Reuters: The Islamist terrorist threat to the West will endure for years to come because simply taking back territory from Islamic State will not solve the deeper global fractures which have fostered militants, Britain’s foreign intelligence chief has said.

In his first public comments outside Britain, the head of the Secret Intelligence Service said globalization, the information revolution, a deepening sectarian divide in the Middle East and failed states would ensure that terrorism remained a threat.

When asked by the Central Intelligence Agency Director John Brennan at a panel discussion in Washington whether the apex of the Islamist terrorist trajectory had been reached, MI6 chief Alex Younger said: “Regrettably this is an enduring issue which will certainly be with us for our professional lifetime.”

“I would have to forecast that whilst it is wholly desirable to remove territory you will have a persistent threat representing some of the deep fault lines that still exist in our world,” he said.

Islamic State militants have lost territory in Iraq and Syria though they have claimed responsibility for a range of attacks against the West.

His remarks were shown on a recording posted on Wednesday by the Center for Cyber and Homeland Security at the George Washington University.

Younger, as chief of MI6, is one of the West’s most powerful spies and rarely speaks in public. He was appointed in 2014 by then Prime Minister David Cameron.

MI6 operates overseas and is tasked with defending Britain and its interests.

Younger said terrorism was fueled by a host of fractures across the world.

“It is fueled by a deepening sectarian divide in the Middle East and there are some deep social, economic and demographic drivers to the phenomenon we know as terrorism,” he said.

Sadly, I have to include this item when it comes to Donald Trump. We already know that Hillary has her own vast spy network. But when Trump has Carter Page who is deeply connected to Moscow, more questions and investigations need to happen, and frankly they are. This all comes at the same time IT professionals are proving that Russia is indeed using cyber spy tactics effectively.

Hey Yahoo Users…..a Big Problem was Finally Admitted, HACKED

Posted on September 22, 2016September 22, 2016 by Denise Simon

Yahoo confirms 500 million accounts compromised in huge data breach

FNC: Yahoo has confirmed that hackers stole information from at least 500 million user accounts in what it describes as a “state-sponsored” attack.

In a statement released Thursday, Yahoo’s Chief Information Security Officer Bob Lord said that the information was stolen from the company’s network in late 2014. “The account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers,” he said.

However, an ongoing investigation into the hack suggests that stolen information did not include unprotected passwords, payment card data, or bank account information, according to Lord. Payment card data and bank account information are not stored in the affected system, he added.

The investigation has found that the attacker is no longer in Yahoo’s network. The internet giant said that it is working with law enforcement.

Yahoo is notifying potentially affected users and asking them to promptly change their passwords.

Early on Friday Recode reported that Yahoo was set to confirm a major data breach of its systems in 2012 that compromised the personal data of 200 million accounts.

****

PYMNTS: Yahoo did announce over the summer that is was investigating a possible data breach wherein hackers claimed to have accessed 200 million Yahoo user accounts that they were selling online.

“It’s as bad as that,” one source told re/code. “Worse, really.”

And a hack that is “bad” on its best description and “worse” than 200 million accounts going up for sale on the dark web may only be the beginning of Yahoo’s troubles this week, since the firm is also in the midst of trying to close a $4.8 billion sale of its core business — which is at the center this hack — to Verizon.

If the scale of liability is large enough, it could be a costly problem for Yahoo’s new owners — and the firm’s shareholders are likely to worry that it could lead to an adjustment in the price of the transaction. As of now the deal is moving forward as it goes through a variety of regulatory clearances. The deal must also pass final muster with Yahoo’s shareholders. Representatives of both firms have recently began meeting to review the Yahoo business and to make sure the transition runs smoothly. We’re sure those meeting will be delightfully fun this week.

If this is the same hack that was reported over the summer, the actor behind the mayhem is an infamous cybercriminal named “Peace.” Peace was, by his own admission, selling credentials of 200 million Yahoo users from 2012 on the dark web for just over $1,800. The data allegedly included user names, easily decrypted passwords, personal information like birth dates and other email addresses. At the time (in August 2016) Yahoo noted being “aware of the claim,” but did not confirm or deny it. However, at the time Yahoo did not issue a password reset recommendation.

If this hack is what it seems to be, it will be a depressing coda on CEO Marissa Mayer’s run at the head of Yahoo. Though brought in to turn the firm around, Mayer was unable to find traction for a reset, refocused Yahoo — which eventually precipitated the sale.

House Office Report on Edward Snowden

Posted on September 16, 2016September 16, 2016 by Denise Simon

Edward Snowden, Defending His Patriotism, Says Disclosures Helped Privacy

© REUTERS/Andrew Kelly

In this file photo, American whistleblower Edward Snowden delivers remarks via video link from Moscow to attendees at a discussion regarding an International Treaty on the Right to Privacy, Protection Against Improper Surveillance and Protection of Whistleblowers in New York City on Sept. 24, 2015. More here.

Executive Summary of Review of the Unauthorized Disclosures of Former National Security Agency Contractor Edward Snowden

UNCLASSIFIED

In June 2013, former National Security Agency (NSA) contractor Edward Snowden

perpetrated the largest and most damaging Public release of classified information in U.S.

intelligence history. In August 2014, the Chairman and Ranking Member of the House

Permanent Select Committee on Intelligence (HPSCI) directed Committee staff to carry out a

comprehensive review of the unauthorized disclosures. The aim of the review was to allow the

Committee to explain to other Members of Congress-and, where possible, the American

people-how this breach occurred, what the U.S. Government knows about the man who

committed it, and whether the security shortfalls it highlighted had been remedied.

Over the next two years, Committee staffrequested hundreds ofdocuments from the

Intelligence Community (IC), participated in dozens ofbriefings and meetings with IC

personnel, conducted several interviews with key individuals with knowledge of Snowden’s

background and actions, and traveled to NSA Hawaii to visit Snowden’s last two work locations.

The review focused on Snowden’s background, how he was able to remove more than 1.5

million classifled documents from secure NSA networks, what the 1.5 million documents

contained, and the damage their removal caused to national security.

The Committee’s review was careful not to disturb any criminal investigation or future

prosecution of Snowden, who has remained in Russia since he fled there on June 23, 2013.

Accordingly, the Committee did not interview individuals whom the Depatment of Justice

identified as possible witnesses at Snowden’s trial, including Snowden himself, nor did the

Committee request any matters that may have occurred before a grand jury. Instead, the IC

provided the Committee with access to other individuals who possessed substantively similar

knowledge as the possible witnesses. Similarly, rather than interview Snowden’s NSA

coworkers and supervisors directly, Committee staffinterviewed IC personnel who had reviewed

reports o finterviews with Snowden’s co-workers and supervisors. The Committee remains

hopeful that Snowden will retum to the United States to face justice.

The bulk of the Committee’s 36-page review, which includes 230 footnotes, must remain

classified to avoid causing further harm to national security; however, the Committee has made

a number of unclassified findings. These findings demonstrate that the public narrative

popularized by Snowden and his allies is rife with falsehoods, exaggerations, and crucial

omissions, a pattem that began befiore he stole 1.5 million sensitive documents.

First, Snowden caused tremendous damage to national security, and the vast

majority of the documents he stole have nothing to do with programs impacting individual

privacy interests-they instead pertain to military, defense? and intelligence programs of

great interest to America,s adversaries. A review ofthe materials Snowden compromised

makes clear that he handed over secrets that protect American troops overseas and secrets that

provide vital defienses against terrorists and nation-states. Some of Snowden’s disclosures

exacerbated and accelerated existing trends that diminished the IC’s capabilities to collect

against legitimate foreign intelligence targets, while others resulted in the loss of intelligence

streams that had saved American lives. Snowden insists he has not shared the full cache of 1.5

million classified documents with anyone; however, in June 2016, the deputy chairman of the

Russian parliaments defense and security committee publicly conceded that “Snowden did

share intelligence” with his govemment. Additionally, although Snowden’s professed objective

may have been to inform the general public, the infiormation he released is also available to

Russian, Chinese, Iranian, and North Korean govemment intelligence services; any terrorist

with Internet access; and many others who wish to do harm to the United States.

The full scope ofthe damage inflicted by Snowden remains unknown. Over the past

three years, the IC and the Department ofDefiense (DOD) have carried out separate

reviews with differing methodologies-fthe damage Snowden caused. Out of an abundance of

caution, DOD reviewed all 1.5 million documents Snowden removed. The IC, by contrast, has

carried out a damage assessment fior only a small subset ofthe documents. The Committee is

concerned that the IC does not plan to assess the damage ofthe vast majority of documents

Snowden removed. Nevertheless, even by a conservative estimate, the U.S. Govemment has

spent hundreds of millions of dollars, and will eventually spend billions, to attempt to mitigate

the damage Snowden caused. These dollars would have been better spent on combating

America’s adversaries in an increasingly dangerous world.

Second, Snowden was not a whistleblower. Under the law, publicly revealing

classifled information does not qualify someone as a whistleblower. However, disclosing

classified information that Shows fraud, Waste, Abuse, Or Other illegal activity to the

appropriate law enforcement or oversight personnel-including to Congressuloes make someone

a whistleblower and affords them with critical protections. Contrary to his public claims that he

notified numerous NSA officials about what he believed to be illegal intelligence collection, the

Committee found no evidence that Snowden took any official effort to express concems about

U.S. intelligence activities-legal, moral, or otherwise-to any oversight officials Within the

U.S. Govemment, despite numerous avenues for him to do so. Snowden was aware of these

avenues. His only attempt to contact an NSA attomey revolved around a question about the

legal precedence ofexecutive orders, and his only contact to the Central Intelligence Agency

(CIA) Inspector General (IG) revolved around his disagreements with his managers about

training and retention ofinfiormation technology specialists.

Despite Snowden’s later public claim that he would have faced retribution for voicing

concems about intelligence activities, the Committee found that laws and regulations in effect at

the time of Snowden’s actions afforded him protection. The Committee routinely receives

disclosures from IC contractors pursuant to the Intelligence Community Whistleblower

Protection Act of 1998 (IC WPA). If Snowden had been worried about possible retaliation for

voicing concerns about NSA activities, he could have made a disclosure to the Committee. He

did not. Nor did Snowden remain in the United States to flee the legal consequences of his

actions, contrary to the tradition of civil disobedience he professes to embrace. Instead, he fled

to China and Russia, two countries whose governments place scant value on their citizens’

privacy or civil liberties-and whose intelligence services aggressively collect information on

both the United States and their own citizens.

To gather the files he took with him when he left the country for Hong Kong, Snowden

infringed on the privacy of thousands of govemment employees and contractors. He obtained

his colleagues, security credentials through misleading means, abused his access as a systems

administrator to search his co-workers, personal drives, and removed the personally

identifiable information of thousands of IC employees and contractors. From Hong Kong he

went to Russia, where he remains a guest of the Kremlin to this day.

It is also not clear Snowden understood the numerous privacy protections that govern the

activities of the IC. He failed basic annual training for NSA employees on Section 702 of the

Foreign Intelligence Surveillance Act (FISA) and complained the training was rigged to be

overly difficult. This training included explanations of the privacy protections related to the

PRISM program that Snowden would later disclose.

Third, two weeks before Snowden began mass downloads of classified documents,

he was reprimanded after engaging in a workplace spat with NSA managers. Snowden was

repeatedly counseled by his managers regarding his behavior at work. For example, in June

2012, Snowden became involved in a fiery e-mail argument With a Supervisor about how

computer updates should be managed. Snowden added an NSA senior executive several levels

above the supervisor to the e-mail thread, an action that earned him a swift reprimand from his

contracting officer for failing to follow the proper protocol for raising grievances through the

chain of command. Two weeks later, Snowden began his mass downloads of classified

information from NSA networks. Despite Snowden’s later claim that the March 2013

congressional testimony of Director of National Intelligence James Clapper was a “breaking

point” for him, these mass downloads predated Director Clapper’s testimony by eight months.

Fourth, Snowden was, and remains) a serial exaggerator and fabricator. A close

review of Snowden’s official employment records and submissions reveals a pattern of

intentional lying. He claimed to have left Army basic training because of broken legs when in

fact he washed out because of shin splints. He claimed to have obtained a high school degree

equivalent when in fact he never did. He claimed to have worked for the CIA as a “senior

advisor,” which was a gross exaggeration of his entry-level duties as a computer technician. He

also doctored his performance evaluations and obtained new positions at NSA by exaggerating

his resume and stealing the answers to an employment test. In May 2013, Snowden informed

his supervisor that he would be out of the office receive treatment for worsening epilepsy. In

reality, he was on his way to Hong Kong with stolen secrets.

Finally, the Committee remains concerned that more than three years after the start

of the unauthorized disclosures, NSA, and the IC as a whole, have not done enough to

minimize the risk of another massive unauthorized disclosure. Although it is impossible to

reduce the chance of another Snowden to zero, more work can and should be done to improve

the security of the people and computer networks that keep America’s most closely held secrets.

For instance, a recent DOD Inspector General report directed by the Committee found that NSA

has yet to effectively implement its post-Snowden security improvements. The Committee has

taken actions to improve IC information security in the Intelligence Authorization Acts for

Fiscal Years 2014, 2015, 2016, and 2017, and looks forward to working with the IC to continue

to improve security.