I would say being a self-taught computer expert who out-smarted the most technically advanced intelligence agency in the history of the world at their own game would lend itself to being a body of work. He also outmaneuvered the State Department and as a lone actor has been able to thumb his nose at the most powerful people in the world while his data has been front page news in dozens of countries around the world for months. It's all quite surreal and I would not underestimate the man.

> ...out-smarted the most technically advanced intelligence agency in the history of the world at their own game...

The lifting of sensitive NSA documents smells to me of gross incompetence. It troubles me that this hasn't gotten more discussion.

Snowden was working for Booz Allen Hamilton in Hawaii. While working for this government contractor, he managed to copy a great many secrets that were probably supposed to be very inaccessible to him.

1) Why does the NSA outsource IT work (and, more critically, the storage of extremely sensitive information) to a third party? (Or do I misunderstand BAH's role in the matter?)

2) One of the NSA's missions is to provide computer security to USGov and the nation as a whole. How good at that job could they possibly be if they can't keep their secrets from insiders who wish to obtain them?

3) Snowden has not been outed as black, white, or grey-hat hacker. It has been claimed that Snowden asked other co-workers with greater access for their credentials and used those to copy sensitive data. Either that claim is true, or BAH seriously fucked up their SELinux permissions and gave sysadmins read access to everything. Either way, the documents were likely not obtained through technical wizardry, but were likely acquired through exploitation of human incompetence. Snowden may be a very skilled individual, but it seems very likely that his skills had nothing to do with the acquisition of that document cache.

You seem to think that exploiting human weakness is somehow out-of-bounds for attackers. Do you, by any chance, set policy for the NSA?

Exploiting human weakness is totally fair game. I am not an NSA policy setter. I have never directly worked for any government agency, but I have worked as a computer security auditor. If you don't account for human weakness in the threat models for your high value assets, you've already lost.

While there are no silver bullets, there are auditing policies [0] and technological mechanisms [1] that attempt to prevent improper use of credentials or improper access of information, and can detect instances of the same after the fact.

Yes, this sort of thing requires a lot of thought to set up, personnel to maintain, political capital to keep going, and regular objective and honest reevaluations to ensure continued effectiveness. However, I don't see any other way to do this if you've data that you need to protect from your enemies.

If protecting the NSA's highly sensitive information isn't worth all that trouble, is it actually worth protecting?

[0] Such as daily inspection of badge-in, badge-out, log-in, log-out, and document/resource access logs to verify physical presence and ensure that one isn't reading things that one's not supposed to have access to.

[1] Such as proper use of SELinux for fine-grained access control, WORM logging devices for tamper-resistant logging, account lockouts on detection of data access or log-in irregularities to minimize damage from account "spoofing" [You're at lunch, but you logged in to another computer? You badged-out for the day, but pulled some document from backup at the office? Instant lockout, termination of all of your processes across all systems, and message to facility security.], etc. etc..

Exactly. Exploiting the human elements of a system is often the best way into any system that is trying to be secure. It's been that way since forever. There's even an entire book on the subject by Kevin Mitnick that is very well known, "The Art of Deception: Controlling the Human Element of Security"

Aye. Would one think that the computer security guys at the NSA are unaware of the vast body of literature on social engineering? ;) (I don't think that you do, it's a rhetorical question.)

I suspect that it's very likely that the NSA fucked up, big-time when they designed their internal security and auditing system. With the system in the state that it must have been, would they even know if an agent from $ENEMY_COUNTRY_OF_THE_MONTH had siphoned off sensitive data, shipped it back home, and vanished into the night?

I mean, the only way we became aware of this leak was the Guardian's announcement of it. It kinda feels like the NSA became aware of the situation at about the same time that we did.

I think we're on the same page here; sorry for misunderstanding before. b^)

If NSA have failed as hard in securing their systems as they seem to have, it makes me think that in the past they've relied on the vetting process to screen out decent Americans like Snowden. I don't think that's enough to keep out determined nations with cosmopolitan citizens, so it's a good bet that Snowden was preceded, and will be followed, by spies of all stripes. If we don't really need an NSA capable of keeping secrets, we probably don't need an NSA at all.

(Moved to another post, as editing posts after an hour seems kinda tacky.)

The media has been banging the "Snowden was the SMARTEST HACKER! NOONE ELSE COULD EVER HAVE DONE THIS BECAUSE HE WAS SO SMART AND STRANGE!!" drum really, really hard. I'm mentioning the human factors because human and internal policy fuck-ups are simply a far more likely explanation.

The Government would love for everyone to believe that this was a one-off event by an exceedingly clever adversary. "We were outsmarted by a super-smart guy who hates America" sounds so much better than "We failed to properly plan for an internal threat, and have failed to do so for years".

I really wonder how many times this sort of thing has been pulled off, undetected, by hostile actors. Just how much of the NSA's massive trove of data has been siphoned off by state-level actors?

His achievements, in so short a life, are nothing less than astounding.

Independent evidence is clearly going to be thin on the ground if he was doing work for the NSA. As mentioned before, it's the opinion of his co-worker. Now that co-worker may have been an incompetent and saw everything that Snowden did as 'genius'. Or, it may be the case that he really was one. Who knows, but at least it's a slightly different viewpoint on the thing.

Body of work? Perhaps you may have heard about his NSA leaks?