<story><title>Botched CIA Communications System Helped Blow Cover of Chinese Agents</title><url>https://foreignpolicy.com/2018/08/15/botched-cia-communications-system-helped-blow-cover-chinese-agents-intelligence/</url></story><parent_chain></parent_chain><comment><author>solatic</author><text>&amp;gt;But the CIA’s interim system contained a technical error: It connected back architecturally to the CIA’s main covert communications platform. When the compromise was suspected, the FBI and NSA both ran “penetration tests” to determine the security of the interim system. They found that cyber experts with access to the interim system could also access the broader covert communications system the agency was using to interact with its vetted sources, according to the former officials.&lt;p&gt;&amp;gt;In the words of one of the former officials, the CIA had “fucked up the firewall” between the two systems.&lt;p&gt;If you read between the lines, this raises the suspicion that there&amp;#x27;s a common underlying infrastructure which handles the communications, with management front-ends for different users which are firewalled off from each other, and the security of the system relied upon the firewall between the different front-ends to prevent users from finding out about each other. However, an attacker who compromised the &amp;quot;less secure&amp;quot; front end, could use that as a launching pad to attack the underlying communication infrastructure, and if the attacker pwned the infrastructure, then he&amp;#x27;d have a back entrance to the &amp;quot;more secure&amp;quot; front end.&lt;p&gt;If that&amp;#x27;s the case, then somebody was grossly incompetent, depending on the age of the system: if the system is old enough, then somebody running ops in the CIA is incompetent, for continuing to operate a system whose security model (&amp;quot;all you need is a strong enough firewall!&amp;quot;) was obsolete; if the system is young enough, then either the original architects, or the security engineers who certified the architecture (if there were any), for proposing an architecture with an obsolete security model.&lt;p&gt;Arguably, that incompetence amounts to criminal negligence, since it resulted in the deaths of US agents, and somebody should be tried for it.</text></comment>
<story><title>Botched CIA Communications System Helped Blow Cover of Chinese Agents</title><url>https://foreignpolicy.com/2018/08/15/botched-cia-communications-system-helped-blow-cover-chinese-agents-intelligence/</url></story><parent_chain></parent_chain><comment><author>yborg</author><text>It took 8 years for the CIA to figure out what happened?? This certainly explains why China and Russia continue to conduct cyber operations basically at the same level of intensity they have been for years - US intelligence, despite its enormous, unaccountable budget is unable to stop them or even know where they are compromised. If there is an actual hot conflict between the US and either of these nations, I shudder to think what will happen.&lt;p&gt;I don&amp;#x27;t believe the US lacks in technical skill at the operational level. These failures are management and organizational failures.</text></comment>