It is like a scene out of the television show 24. An intelligence officer is surfing a top-secret government file that is out of his normal work portfolio. A computer program alerts a “data analyst,” who then monitors the officer’s computer activity. If the officer acts like a potential leaker, sending an encrypted email or using an unregistered thumb drive, the analyst might push a button and watch a screen video of the officer’s last hour of work. Once a case is made that a leak might be imminent, it is checkmate: the agent is thwarted.
That is the kind of scenario Ryan Szedelo, the manager for Raytheon’s SureView software, is describing this week for intelligence professionals in San Antonio shopping for new gizmos at the annual GEOINT conference. The government is already beginning to use the software and others like it in a concerted effort to clamp down on secret leaks.
“SureView is designed to capture the next Bradley Manning,” Szedelo said of the Army private who uploaded hundreds of thousands of classified documents from the military’s secret Internet protocol router network (SIPRnet) onto a remote server affiliated with WikiLeaks.
With his secret clearance, Manning had access not only to the raw intelligence reports in Iraq, but also to aircraft videos, analysis from the field in Afghanistan, and candid diplomatic cables from U.S. embassies all over the world.
“Had SureView been on Bradley Manning’s machine, no one would know who Bradley Manning is today,” Szedelo said in an interview.
SureView is a type of auditing software that specializes in “behavior-based internal monitoring.” It is designed to identify and catch what is known in the counterintelligence trade as the “insider threat,” a trusted user who is willing to steal the secrets he or she is obliged to protect.
Until very recently, WikiLeaks had many leaders of the U.S. intelligence community willing to pull back the kind of intelligence sharing started in earnest after the Sept. 11, 2001, attacks. Last October, Director of National Intelligence James Clapper said at a speech in Washington that “the WikiLeaks episode represents what I would consider a big yellow flag.” He added, “I think it is going to have a very chilling effect on the need to share.”
Today Clapper is taking a different tone. This week at GEOINT, the annual trade show for the intelligence industry, Clapper said one of his top priorities was to merge intelligence collection with intelligence analysis, a process that by definition would require much more sharing among the 16 U.S. intelligence agencies under his direction.
What has changed in the last year is the technology to catch the next big leaker.
“The trick is, can we allow robust sharing for analytical and operational purposes and protect the information at the same time?” House Intelligence Committee Chairman Mike Rogers (R-Mich.) said in an interview. “I argue yes, there are lots of ways to do it.”
Rogers said he favors something called “smart access,” where an intelligence analyst not only would be monitored but would have to be cleared or authenticated to enter specific servers outside his or her purview. “These are just trip wires. I prefer you have to knock on the door to get in—you should need to be authenticated to get into the next level.”
The intelligence community has had auditing software for years. SureView came on the market in 2002. But the programs were buggy and often prone to false positives, alerting a network administrator too often to routine behavior. In the last year, according to three U.S. intelligence officials who asked not to be named, the software has become more automated and easier to apply to larger databases.
“The technology has gotten substantially better in the last year,” said Jeffrey Harris, a former head of the National Reconnaissance Office, the intelligence agency responsible for launching spy satellites. “The problem with audit files was it took an army of people to understand them. Now we have rule-driven systems and expert systems that help us reason through the data.”
Charles Allen, who served as the first intelligence chief for the Department of Homeland Security, said the base where Manning was stationed in Iraq did have auditing software in place that could have caught him, but it was not yet implemented. “In the future, military intelligence units in the war zones and elsewhere will ensure there is a strong audit capability,” he said.
Allen has a point. Earlier this month, President Obama signed a new executive order on protecting classified information. The order created a new “insider threat task force” inside the intelligence community, chaired by the attorney general and the director of national intelligence.
The new directive from the White House is driven in part by new technology. The budget for this kind of counterintelligence software is still secret, but judging from the trade-room floor, it’s a major draw for the U.S. government. The Science Applications International Corporation (SAIC) is offering a software system called Checkmate to detect external threats. A companion product still in development for the internal threat is called Inmate.
This kind of auditing software is one growth area in a new era of shrinking intelligence budgets, Lynn Dugle, president of Raytheon Intelligence and Information Systems, told The Daily Beast. “We absolutely think there will be growth in the insider threat–internal monitoring market,” she said.
Trevor Timm, an activist for the Electronic Frontier Foundation who closely watches the legal issues raised by WikiLeaks, said: “The government has every right to secure their own networks, but if they want to really stop leaks, they need to stop classifying so much information that is not really secret.” Timm added: “The government classified a staggering 77 million documents last year, a 40 percent increase on the year before. And a recent report to Congress showed 4.2 million people have classified security clearances. That’s more than the city of Los Angeles. As long as the government won’t address this underlying problem, people will always find ways to leak, no matter the security.”
