site banner

Culture War Roundup for the week of April 17, 2023

This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.

Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.

We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:

  • Shaming.

  • Attempting to 'build consensus' or enforce ideological conformity.

  • Making sweeping generalizations to vilify a group you dislike.

  • Recruiting for a cause.

  • Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.

In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:

  • Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.

  • Be as precise and charitable as you can. Don't paraphrase unflatteringly.

  • Don't imply that someone said something they did not say, even if you think it follows from what they said.

  • Write like everyone is reading and you want them to be included in the discussion.

On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.

8
Jump in the discussion.

No email address required.

Following the Texeira leak, I have a question which I do not see covered at all in any of the press. Has been there any investigation started into the security structure failures that led to these leaks? It is obvious that it is a systemic failure - a glorified janitor shouldn't have an access to top secret documents, and most of these documents didn't have much business to be on National Guard airbase anyway, they don't have anything to do with whatever Air Force is supposed to be dealing with. Somebody is responsible for the security on Otis Air National Guard Base - and that somebody screwed up big time. Do we know about anybody being places on leave, suspended, demoted, whatever it is? What is the usual procedure in the Army when something like this happens? How much consequences could be expected to people responsible for preventing such things from happening?

over and over , we see that big institutions and companies have surprisingly porous security. look at all the big data breaches over the years. we're talking billion dollar companies getting hacked and databases leaked by script kiddies.

It is obvious that it is a systemic failure - a glorified janitor shouldn't have an access to top secret documents

A janitor working in a top secret facility naturally has access to top secret documents, though as I understand it sometimes a janitor would have a lower-level clearance and an escort and do work at a time when such documents are supposed to be put away. But Texeira was not a custodian in the sense of "janitor;" he was a "custodian of classified documents". That means he was responsible for keeping track of the combinations of the safes holding the classified documents and changing them as required. Such a person obviously has access to the classified information.

As for why the documents were at a National Guard airbase, apparently there was some relevant expertise there. Seems weird to me too, but it's not definitely wrong.

Somebody is responsible for the security on Otis Air National Guard Base

Unfortunately, to some degree, that was Texeira.

Unfortunately, to some degree, that was Texeira.

Somebody appointed him to that position. Somebody supervised him. It's not like US Air Force command structure is Biden - Charles Q. Brown Jr. (had to look him up) - Texeira. There's probably some layers in between, and people in those layers have direct responsibility for hiring and supervising their subordinates. Which means, whoever led to the situation where Texeira had full and unsupervised access to secret documents he had no business accessing - failed at their duty. What I am interested in is who these people were and did they suffer (or will suffer) any consequences, commensurate with the degree of their failure.

Looks like he was actually a "Cyber Transport Systems journeyman"; not sure where I read he was the custodian of (physical) documents but that seems to have been wrong. He had undergone a background investigation and gotten a Top Secret clearance, and his job would have lead to full and, yes, unsupervised access to documents. He was supposed to be trustworthy enough to have such access; this is what the background investigation is supposed to determine. Clearly he wasn't, but I'm not sure why you think it was somehow obvious before the fact that he wasn't.

He was supposed to be trustworthy enough to have such access; this is what the background investigation is supposed to determine

I thought the background checks are supposed to determine if someone could bribe/blackmail you into disclosing secrets.

That's one of the things a background check is supposed to determine, but it's much more than that, see here

but I'm not sure why you think it was somehow obvious before the fact that he wasn't.

You don't just give 21 yo who you've just hired recently (obviously, you couldn't have hired him while he's in high school) the keys to the castle with zero supervision. No matter if he looks super trustworthy, it is not how it should work. In fact, I see no reason why non-audited access to the documents should be given to anyone, and why anyone should be accessing this level of documents without leaving the audit trail and probably raising some alerts as to why these documents are accessed by a person who has no tasks assigned related to these documents. Like, you don't have to initiate full-scale FBI investigation immediately, but if his supervisor got an alert that the guy who is supposed to be a technician is accessing the docs about Ukraine and Israel and what not, which he has no business with - and if he's a competent manager - he'd call him and ask him what is going on, and all this charade may have not gotten out of hand as it did.

You don't just give 21 yo who you've just hired recently (obviously, you couldn't have hired him while he's in high school) the keys to the castle with zero supervision.

Who has been through the background check process and gotten a security clearance. Yes, you do, if by "zero supervision" you mean they can do things without someone looking over their shoulder all the time; obviously they have a boss. When you got your first professional job, did you not get access to all sorts of company confidential documents right away? You probably had to, because your job required working with those documents. It's the same for classified materials, except there's that extra background check process and rather more severe penalties for leaking.

In fact, I see no reason why non-audited access to the documents should be given to anyone

Who said the access wasn't audited? Apparently this guy did nothing to cover his tracks. But also, who would be looking at the audit trail? People in classified environments aren't working in a panopticon with their superiors suspecting them all the time. The audit trail is useful after the fact once it's known the documents had been leaked.

Who has been through the background check process and gotten a security clearance.

He has no "background" to speak of, so background check is useless. Justifying the failure by "but look, here's the checklist we designed, and all the checks are checked! We even used the fully approved pen and the font is in full accordance with regulations!" is a very clear example of turning it into a cargo cult.

did you not get access to all sorts of company confidential documents right away?

Nope, I did not. I now have 30 years experience and an impressive sounding title, and I still don't have access to a lot of company documents or permissions, and I am glad I do not.

because your job required working with those documents

Texeira's job did not require working with those documents. That's the point. Nothing in Texeira's job required knowing how the Ukrainian counter-offensive preparations are going and what Russians think about it. In fact, I don't think I'd be too wrong if I assume there probably no more than one or two persons on that whole base, and maybe none, who needed to know anything about that.

Who said the access wasn't audited?

It's obvious from the fact that they didn't know where it came from and for how long it was allowed to continue unchecked. If there were audit, it'd discover who accessed those docs and the general pattern of accessing docs he has no business accessing very quickly.

People in classified environments aren't working in a panopticon with their superiors suspecting them all the time

They should be. Somehow the rest of us living in a panopticon gets much less pushback than people working with "top secret" documents being supervised while reviewing those documents. If anybody deserved the panopticon, it's them.

The audit trail is useful after the fact once it's known the documents had been leaked.

And yet, that's not how Texeira has been found out - instead, open-source researchers and journalists talking to his game buddies got to the target first.

Nothing in Texeira's job required knowing how the Ukrainian counter-offensive preparations are going and what Russians think about it.

Evidently, TANG MANG disagreed before this incident. The reason why may be left to raw speculation, but it seems prosaic to say that the Tennesee Massachusetts Air National Guard (or the organization above it) had its reasons for having access to this information.

Of course if somebody in the government does something we don't understand, it always because they have their ineffable ways, which can not be understood by mere mortals. Never attribute to inefficiency and rigidity of humongous bureaucracy what you could attribute to ineffability and unknowable reasons.

He has no "background" to speak of, so background check is useless.

Certainly he has a background; he's 21 years old, not a newborn.

Nope, I did not. I now have 30 years experience and an impressive sounding title, and I still don't have access to a lot of company documents or permissions, and I am glad I do not.

Seems very strange. At every company I've worked at I had access to a whole bunch of confidential material. Not all of it, naturally, but a good chunk. Texeira didn't have access to the US government's entire classified output either, of course.

And yet, that's not how Texeira has been found out - instead, open-source researchers and journalists talking to his game buddies got to the target first.

Yes, that's because he was incredibly sloppy. Had he successfully leaked the documents without it being easy to find him by tracing the leaks back to him, the audit trail would let them trace forward to find and question those who could have leaked them.

Certainly he has a background; he's 21 years old, not a newborn.

He's not Brett Kavanaugh, so what he did in high school hardly matters. If he did something that does matter, like having a criminal record, he probably wouldn't be nowhere near that position anyway, in fact probably wouldn't be in the National Guard to begin with.

Texeira didn't have access to the US government's entire classified output either, of course.

He had much more access than his work needed him to, that's the point.

the audit trail would let them trace forward to find and question those who could have leaked them.

You're saying like existence of that trail is an established fact, but it's not. I strongly suspect it in fact does not exist.

More comments

There’s probably a specific institution in charge of security clearances, and whoever made the decision to put Texeira in the job he has was not expected to show individual judgement after the security clearances people made their determination.

Just a question for the tech community here. Why is it necessary to give someone permission to read the contents of a file in the course of network maintenance, support, and upgrades? It seems like most of that would involve file integrity, moving files about, backing them up, but it doesn’t seem obvious that anything in that job should require the ability to be able to open or read the files in plain text. Had he downloaded encrypted files, it’s doubtful that anyone outside the CIA/FBI and other cleared individuals would be able to break a top secret encryption scheme, which makes it appear that the files themselves were in plain text. But I can’t think of a good reason to not encrypt this stuff in such a way that people without authorization can read them even if they managed to download them and sneak out with them (which also shouldn’t be possible).

It is not necessary, but having someone work on a system with confidential shit on it defacto means they can see confidential shit.

With security, can and will are the same thing. So, every everyone who even gets close to the room the network equipment for the room the computers are in needs to be cleared.

's why your work computer should be a locked down piece of shit where every usb port has a small outward facing explosive in it.

Why is it necessary to give someone permission to read the contents of a file in the course of network maintenance, support, and upgrades?

It is not. However, working with encrypted files is harder than with plaintext ones, e.g. something like search is much harder (though with recent advanced in homomorphic cryptography may be finally possible). On top of that, from what experience I have hard with government systems, they are often old, technologically backwards and poorly maintained. And the Higher Powers usually do not understand how the systems work and what is the conditions there, until it's too late (i.e. seeing the article in WaPo about a security leak).

However, working with encrypted files is harder than with plaintext ones, e.g. something like search is much harder

A far bigger deal is that large organisations don't want to lose data to a forgotten password - where the organisation can, of course, also "forget" a password by virtue of the person who knows it ragequitting or falling under a bus. That stops you using the types of encrypted storage that actually work.

In general, if you can recover from a forgotten password, then the (generally relatively junior) IT guy who handles password recovery can steal your data. As a "Cyber Transport Systems Journeyman", Texeira had that kind of access.

A far bigger deal is that large organisations don't want to lose data to a forgotten password - where the organisation can, of course, also "forget" a password by virtue of the person who knows it ragequitting or falling under a bus.

This is all solvable - and largely solved - problems. There are multi-key schemes where you could store passwords in a place that can be unlocked, for example, by using any two (or any other numbers) keys out of N - so each top officer on the base gets one of those master keys, and then if such situation happens, they call two or three of them together and unlock that password. One of the ways to do it, another just make multi-key encryption to the data itself (it's practically the same thing as nobody uses passwords now to directly encrypt data, there are usually intermediate keys anyway).

Even if you use some kind of off-the-shelf commercial product that does not support easy password recovery, because of course as an US Army with trillion dollar budget and its own research branch that invented the freaking internet, you are not able to use state-of-art technologies, there are still off-the-shelf products that offer password management and recovery. It's not something that nobody else heard of, it's a known problem with known solutions.

the (generally relatively junior) IT guy who handles password recovery can steal your data

Only if you design your security poorly. Day-to-day password recovery should require something that the legit user has and IT guy doesn't (phone, card, device, name of the dog, whatever - there are dozens of ways). Hit-by-a-bus password recovery should require participation of higher level key holders - and they should bear the responsibility for the misuse (aka you give your colonel's keys to the janitor - you may get early retirement and never make a general, etc.) There are a lot of schemas that allows to handle it without giving access to IT janitor to every single bit of top secret data.

I agree that the problem is solvable in an organisation that actually cares, although I disagree that it is easy. Banks (which probably care more about securing money than the military does about securing classified information) do in fact do all these things. And even they run into the problem that any system that requires busy executives to do their own admin will be circumvented. The US army (and, frankly, every peacetime army) is the type of organisation where every colonel has given his keys to the janitor at some point. Quora is absolutely full of "war stories" of the type "I, as a lowly PFC ordered to guard the outer door of a SCIF had to point my rifle at a colonel who was mishandling classified information, and the following morning the brigadier congratulated me." Colonels wouldn't do that if the more normal response was for the PFC to let them.

although I disagree that it is easy

I never said it's easy. I deal with security professionally from time to time (though mode code security than people security) and I would never use the word "easy" when it comes to security. Yes, it requires effort, thought, careful application and the most important, as you very correctly noted - "organisation that actually cares". Of these, the US military has plenty of resources and access to plenty of smart people, more than capable to solve such problems - but as I suspect, it is just not that kind of organization. They say they care, but in the immortal words of Forrest Gump, careless is as careless does.

every colonel has given his keys to the janitor at some point

I have no doubts fuckups happened and will happen, now and forever on. Most of all in the military. What I am more interested in is what happens after. Does the colonel lose their chance to become general and gains eternal shame, demotion to managing the least important storage of old socks in the nation, and derision of all his peers - or he keeps failing upwards until one day he may become Chief of Staff? Is there some push to make it happen less often, on the usual SNAFU response?

It seems to me you are assuming that the main goal of a secret document is to remain secret, while it is actually to be read by some people (else, there are better ways to avoid leaks, like not having any secret document). So there is some kind of trade off between the security measures, and who will be able to read the document. At some point, you have to decide if it's worse that sometimes documents leak, or that someone doesn't get the information he should get. It seems to me that the incentives are strong enough to avoid leaks most of the time (the guy will spend his life in prison because he wanted to brag on discord...).

What's more worrying in my view is the time spent between the leak and the guy getting caught. If it takes one year to detect a leak from a dumb soldier unable to cover his tracks, you can guess that china has access to most us secret document.

This might be my particular version of doomerism, clichéd shaking my head at the youth these days, etc., but I think we're going to see more of this sort of stuff as boomers retire/die.

America in particular is going to be pretty screwed as it discovers how much of the system depended on people being mostly good faith and competent.

I think most of democratic societies depend on that - you can not have civil rights and have a system that does not depend on the vast majority of people being good faith. As defection becomes the norm and is celebrated, people that liked it as it were before start demanding on heavier enforcement. China leads the way, but social score will probably happen in the US too, at least if they find a way to make it compatible with DIE ideology and explain to the AIs how to make it racist in the right way without making it racist in the wrong way. On the other side, as more and more people feel the system is obviously not working for them, the drive to defect would become stronger. Why be good and work hard if lazy and evil people prosper in front of your very eyes? Traditional moral systems (like Christianity, but not exclusively of course, there are many more) had an answer to that, but they are domestic terrorists now. And the new civic religions pretty much declare the modern Western civilization the root of all evils, so they can't really be relied on to counter the decline and destruction.

And you think those people...are the boomers? That boomers are, on average, more prosocial than Gen-Xers? More competent?

Do you think the Silents said the same thing as they watched their kids grow into the workforce?

I'm sympathetic to the vast loss of institutional knowledge lost as our old wizards retire. I've watched it happen. I've also seen it happen with middle-aged engineers flirting with burnout or managers folding under pressures on the company. Modern professionals are every bit as capable as their counterparts were at the same age.

I think there's more to say about the good faith part of the equation.

For all their faults, boomers believed in the system because it benefited them tremendously.

What sort of rube would hold any loyalty to it now as a young man?

You could say their belief in the system has benefitted them tremendously. How does boomer wisdom go? "If you're not against the system at 20, you have no heart; if you're against the system at 30, you have no head." They weren't born loyal, they recognized that a cascade of defection would not end well, then got paid. What alternative is there? Utopia? Your pals Xi and Putin?

Besides, there's not that many young men, and they can count on their inheritance for the buy-in.

they recognized that a cascade of defection would not end well, then got paid.

Critically, they got paid enough to sleepwalk into home ownership and supporting a family on one income and low effort.

How many zoomers can say that?

What alternative is there? Utopia? Your pals Xi and Putin?

Abstract notions that there's no better system throretically concievable as being able to replace the status quo might be enough of an argument to discourage me from grabbing my AK and joining the armed revolution, but it's not really enough to convince me that I should become a go-getting boomer and strive 110% every day at my wagie job that has a radically worse effort/reward ratio than it did for my grandfather.

Societal buy-in requires some better incentives than "If you don't work unpaid overtime, China will win!"

It's simple, really. Either your parents owned a house in New York/London/Munich, in which case you're going to be rich without having to work at all, or you can easily get a house (+ some amenities they never even dreamed of) elsewhere where they did, like they did: by working a 9 to 5.

Logistics runs through everything. If you can’t get upper-level PMC people to do the field-specific equivalent of janitorial work, you have to get a glorified janitor to do it.

My understanding is that he was low-level IT for classified networks, specifically JWICS.. That would mean access to terminals which can pull down such documents rather than actual, physical copies.

In a civilian installation, there are lots of rules about access control for classified networks. I would expect most of them to hold even though the airbase is already an elevated environment. If there was supposed to be a buddy system, no one left alone with a terminal, then either there was an accomplice or said system wasn't enforced. If there were record reviews which should have caught his activity, someone could take flak for that. Other than that, hard to say if anyone higher up the chain gets blame. The most likely outcome is close scrutiny and the addition of half a dozen new procedures to learn.

If there was supposed to be a buddy system

My guess is that there was not. Folks like Snowden were in facilities where SCIFs are busy. Likely multiple people there working together all day sort of thing. IIRC, that's why he had to go the route of sneaking them out via a writable CD that he labeled "Lady Gaga", thinking (correctly, apparently) that the people around him wouldn't be suspicious of it. Similarly, I believe lots of facilities that see significant use have a person whose sole job is just running the room. They schedule folks to use it, make sure the equipment is working, are around to help out if there are difficulties, and are just sort of there, so they could potentially see any mischievous behavior.

On the other hand, Massachusetts Air National Guard? Probably low volume usage. This dovetails with the questions like, "Why do they even have access anyway?" because I have to imagine it's not used that much. One of those, "Well, we have the terminal here, just so that when the occasional bloke does need something, he doesn't have to drive an hour down the road to another site." Obviously, choosing to maintain low volume terminals has risks like this. And I wouldn't be surprised if they didn't have a buddy system.

Even with a buddy system, they have to choose some set of people to have the authority to open up the room in the first place, and I doubt there are technological controls to make sure that those guys take a buddy in at the time. If he was one of the few people who used it for legitimate purposes, I wouldn't be surprised if he was given that authority; he has the proper clearance, after all. If so, then what are the real technological controls that can be put in place to ensure that he takes a buddy in with him? Most likely, if he had authorization to open the SCIF, even if they had a buddy system, I imagine he pretty much just had to write down someone's name to claim that they were there. Obviously makes a record that could be discovered as fraudulent, but what are the chances of that? He could just go in at times when basically no one else is around, write down a fake buddy, and even just take his phone in with him to take pictures of stuff.

The pictures seem to show printed documents in a rather large format -- I'm sure you could find this kind of printer at a secure intelligence location, but I should think that there'd be some kind of special controls around it?

My work laptop won't even take a USB stick -- how else is he getting the documents out? Leaving aside the fact that photographic devices should also be controlled in such places, the images I saw didn't really look like phone snaps blown up a Walgreens -- they take up a big chunk of his kitchen table!

The pictures seem to show printed documents in a rather large format -- I'm sure you could find this kind of printer at a secure intelligence location, but I should think that there'd be some kind of special controls around it?

Certainly an audit trail, but it appears he made no attempt to cover his tracks anyway. Probably not any controls to prevent people from using it... and certainly none that would keep the IT guy out.

how else is he getting the documents out?

By stuffing the printouts down his shirt?

One would think that people at a SCIF would notice if their classified documents were going missing?

Or just folded up and put in a briefcase or bag. Most places they don't search the employees on the way out every day. (There are apparently some places like that, but not all. I imagine it would be even harder to get people to do the work if that were done).

I would expect military intelligence, even its discount NG variant, to have security protocols in place that handle that.

Our class actually smuggled a few notebooks with confidential data out of ROTC for exam prep, but that required actual conspiracy by multiple cadets and could've been stopped by simple measures like not letting us bring non-classified notebooks to confidential classes.

I would expect military intelligence, even its discount NG variant, to have security protocols in place that handle that.

I don't know the military/national guard side, but it wouldn't surprise me if they often didn't. I've worked on the civilian side. If a person with a clearance wanted to walk out the door with a classified document, there was nothing at all to stop them or even detect them.

Did he get the documents from his own terminal or other people's terminals?

Janitors getting top secret clearances happens regularly.

Secret documents get leaked regularly too. Should somebody be held responsible or the approach is like que sera, sera?

I think first one would need to show that there's a viable alternative. As @Quantumfreakonomics pointed out, someone needs to do janitor duty in the closed area. That person needs to have a security clearance so that they can go in there. That means that no matter how unreasonable it may seem on its face, literal janitors are going to be granted top secret clearances. I don't necessarily disagree that this seems dumb, but I also don't know that I see a better way.

someone needs to do janitor duty in the closed area

True, but the secret documents don't have to be laying around, ready to be photographed, when they do it. There are such things as safes.

literal janitors are going to be granted top secret clearances

Don't see how it follows. Getting physical access to where the safe stands and getting inside the safe is two different things. That's kinda the whole point of the concept of the safe.

I had a very close friend(RIP) who worked in engineering in Lockheed-Martin's test lab, and was briefly looking at signing on for blue collar work(in this case maintenance, not janitorial) in the facility in question. While I'm too involved in political radical groups of multiple descriptions to have thought it worth trying to get through the years long process of getting a security clearance to work in the trades in a military test lab, it seemed like even the lowest blue collar functionaries absolutely needed to be trustworthy and trained on information security to prevent leaks from things like improper trash disposal, and also to catch breaches of protocol by the people who worked with the information in question.

True enough, but you've just moved your point of failure to "is everyone going to always put their documents away". Which, having had enough experience with users, I feel very confident in saying they definitely will not.

Perhaps this is a potential market for Boston Dynamics. An airgapped robot with janitorial tools instead of hands seems fairly hack-proof, or at least less likely to access secret information than a human.