As a sysadmin he probably had root access to a ton of systems. Own the infrastructure, own the organization.

You can still tier access, even to users with root access by encrypting files at rest.

I find it highly concerning that a not-particularly-high-level employee was able to gain access to so much data. The amount of access and permission controls at Booz seem amateur from a distance.

People tend to imagine the wildest things with things as secretive as the NSA.

But remember this is just another $20B agency. Odds are their computer systems are as terrible as any other agency.

A random analyst was able to download millions of state embassy cables and they would still be looking for him today if he didn't trip up in private chats. Testimony in the Manning case indicates that mIRC is mission critical software. The blunt face of reality quickly deflates all the sci-fi.

That's not an apt comparison, because Manning had access to the cables by design. He exceeded his authority by releasing the information, not by accessing it.

After 9/11, which the US had enough information to stop if not for that information being held by different agencies that did not share with each other, an effort was made to make sure analysts in different agencies and branches all had access to anything that might be relevant.

He had access to millions of cables in just a few days. Every porn site has better tracking and mass download detection.

Yeah, you can, but it doesn't look like the systems were built that way. Honestly, the state of cybersecurity is pretty bad throughout both the public and private sectors. Somehow I doubt the NSA is immune to that trend.

>Yeah, you can, but it doesn't look like the systems were built that way.

Both Linux and Microsoft support file permissions. No excuse.

File permissions aren't nearly enough here. He had access to their network systems, so you'd need encryption in transit as well, and a thousand other safeguards at both the software and hardware level.

Not to mention, Snowden was an offensive cybersecurity researcher. He knew the NSA's safeguards in and out, and thus was intimately familiar with their weaknesses. He could most likely plant malware wherever he wanted. If you think security at that level is as trivial as file permissions, you haven't thought through the problem realistically.

This is all of course, speculation. My main point is that, regardless of the reasoning or other theoretical designs, current NSA systems do not appear to have fine grained unbreakable access control.

Can we ask him about JFK ;-) ?

the aliens, tell us about the aliens!