Out of Band

WikiLeaks and the Matter of Private Manning Hal Berghel, University of Nevada, Las Vegas

The release of significant documents by WikiLeaks, the international online not-for-profit organization, has become front-page news that has significant implications for computing professionals.

hat a time for Wiki- with both Asperger’s syndrome and were embarrassed by the Collat- Leaks. This story has other alleged personal issues. The eral Murder video because some of taken wing. prevailing media perspective at this the victims were Reuters’ war cor- W In 2010, Wiki- writing holds that the WikiLeaks respondents and children. Defense Leaks.org, the self-proclaimed EiC somehow got secret—and very officials and the military were also not-for-profit online repository of embarrassing—documents from the embarrassed by the 75,000 docu- leaks, posted some Army private, and then had them ments (most of which were classified politically charged and embarrass- posted on the WikiLeaks website. “secret”) that were released as the ing digital content dealing with In a weaker moment, the private Afghan War Diary, but for different the Afghanistan war (the “Afghan then discussed his involvement in reasons. These documents included War Diary”), gunsight footage of this derring-do with Lamo. The latter intelligence intercepts, internal mili- an airstrike in Baghdad (“Collateral then shared the information with US tary incident reports, speculative Murder”), and thousands of purport- government officials and a reporter assessments, and reports from infor- edly secret US State department for Wired Magazine. At that point the mants, some of which referred to diplomatic cables (“Cablegate”). In plot thickens, fingers point wildly other informants by name, much to addition to attracting the ire of US (and, of course, outward), and seem- the chagrin and alarm of the US and government officials and politicians, ingly everyone with even the slightest sympathetic foreign governments. these leaks embarrassed several for- bit of egg-on-face takes a self-serving But the holy grail of embarrass- eign governments. All three of these position that takes dead aim at the EiC ment was Cablegate: approximately leaks were allegedly the work of Brad- and the private. 250,000 diplomatic cables between ley Manning, a socially awkward, Beyond this, things begin to get the US State Department and nearly somewhat unstable US Army private murky. 300 embassies, consulates, and dip- serving in Iraq. lomatic missions around the world. We add to the mix , KNOWN KNOWNS Of these cables, about one-half a nonconformist former computer The constituencies affected by were unclassified, one-third were hacker who refers to himself as the three leaks are slightly different labeled “confidential,” and approxi- the founder and editor in chief of but overlapping—there’s plenty of mately 15,000 were labeled “secret.” WikiLeaks, and Adrian Lamo, a embarrassment to go around. The WikiLeaks has released only a small convicted computer hacker/snitch Department of Defense and military fraction of the cables thus far; a larger

86 computer Published by the IEEE Computer Society 0018-9162/12/$31.00 © 2012 IEEE Hot Links portion has been shared with major newspapers, including , he complete list of countries with extradition treaties with the US is available at www. , Der Spiegel, El T state.gov/documents/organization/71600.pdf. País, and Le Monde. By the time of the For Zbigniew Brzezinski’s views of the leaks, see www.pbs.org/newshour/bb/ Cablegate leaks, the battle lines were government_programs/july-dec10/weakileaks2_11-29.html. drawn, and the strongly opinionated Several threads of Wired Magazine’s coverage of Bradley Manning’s Article 32 hearing among us began choosing sides and are linked to www.wired.com/threatlevel/2011/12/adrian-lamo-bradley-manning. FIPS 199 can be found online at http://csrc.nist.gov/publications/fips/fips199/FIPS taking aim. -PUB-199-final.pdf. EO 13292 is online at www.archives.gov/isoo/policy-documents/ Cablegate and its predecessors eo-12958-amendment.html. The earlier EO 12958 is at www.archives.gov/isoo/policy produced a veritable feeding frenzy of -documents/eo-12958-amendment.html. accusations from Western politicians, www.WikiLeaks.org and www.bradleymanning.org are relevant to this discussion. most of which were directed toward Julian Assange. Mike Huckabee, a former US presidential aspirant, is and politicians tend to view the leaks THE COMPUTING AND IT said to have called for Assange’s exe- as threatening and subversive and are DIMENSION cution for treason (Assange, it should hostile to Manning and WikiLeaks. There’s no shortage of drama in be noted, is not a US citizen). Aus- The majority of observers seem to this tale. Enter US Senator Joe Lieber- tralia’s Prime Minister Julia Gillard accept the stolen and leaked docu- man and Amazon CEO Jeff Bezos. called Assange a criminal and rec- ments explanation. According to published reports, ommended revoking his Australian However, to add complexity to Lieberman or his staff asked Bezos or passport (which was nullified when the story, there is the “conspiracy” his staff to stop hosting WikiLeaks on Australia’s Attorney General opined account, promulgated by Zbigniew Amazon Web Services—at the time that Assange had broken no Austra- Brzezinski, former National Secu- the primary host of WikiLeaks con- lian law). US Vice President Joe Biden rity Advisor to President Carter: the tent in North America. Mind you, this labeled Assange a “high-tech ter- leaked documents might be back- was after the three leaks had already rorist.” Presidential contender Newt ground noise that overshadows gone viral. When I saw the media Gingrich recommended that Assange the more important and damaging reports of this story, my first thought be treated as an “enemy combatant.” “seeded” documents that were added was, “What part of ‘the toothpaste Conversely, Republican presidential to the mix. In Brzezinski’s view, these is out of the tube’ don’t they under- contender Ron Paul suggested that WikiLeaks should not be taken at face stand?” In any event, Amazon Web Private Manning might be a “politi- value. According to him, it is quite Services did pull WikiLeaks.org con- cal hero … a true patriot who reveals possible, if not probable, that Assange tent from its server cluster. what is going on in government.” and WikiLeaks were duped by “spe- Of course Amazon Web Services Meanwhile the homeless (and cial intelligence interests” specifically wasn’t the sole hosting service for close to being stateless) Assange took to embarrass the US and weaken its WikiLeaks. No one who knew how the refuge in the historic English country relationship with friendly allies. Internet worked thought that it was. estate of a wealthy journalist, docu- Rather than being the channel for When Amazon pulled its content, it mentarian, and restauranteur. So a toxic data dump of secret material, had no effect on content elsewhere. 2012 begins. Assange actually might be the useful Nor did it seem to have any effect on idiot for foreign intelligence services: the continued migration of the docu- KNOWN UNKNOWNS WikiLeaks might be an instrument of ments through cyberspace. The prevailing, but not singular, information warfare rather than the Similarly, when EveryDNS pulled view of the leaks falls under the rubric purveyor of blown whistles. the DNS entry for the WikiLeaks.org of “stolen and leaked documents.” At this writing, it remains to be IP address record for North America On this account, the documents determined whether Assange, work- (after an alleged 100 gigabit/second were government property that ing under an assumed alias, actually distributed denial-of-service attack was downloaded from government encouraged Manning to provide the directed against WikiLeaks.org was servers and subsequently uploaded files to WikiLeaks. This is a critical threatening its service to other sub- to WikiLeaks without permission: determination for Assange, as an scribers), the DNS records for other stolen, pure and simple. Free speech active role might lead to his prosecu- WikiLeak hosts began to proliferate. advocates tend to view these leaks as tion under the US Espionage Act. As networkers worldwide watched a natural byproduct of a free press in And yet, to some extent, the most this unfold, they saw it as nothing a democracy and are sympathetic to interesting part of this story has so far beyond the level of minor inconve- Manning and WikiLeaks. Bureaucrats gone largely unnoticed. nience to curious Internet surfers.

MARCH 2012 87 Out of Band

That government officials and time, Swedish authorities issued an Let’s assume that Private Manning their staffs acted as if they actually arrest warrant and sought to extradite did in fact upload the documents to thought they could magically end the Assange on the sex charge. Assange WikiLeaks by using his access to embarrassment by pulling the plug on considered requesting asylum in the Secret Internet Protocol Router a hosting service is symptomatic of Switzerland, but the Swiss authori- Network (SIPRNet) as Adrian Lamo our cyberdeficiencies. This entire epi- ties balked under US pressure, in part testified. In 2009, Manning would sode will live on as a paradigm case of because Switzerland has an extradi- have been 21 or 22 years old. Unless cyber silliness. tion treaty with the US. the insignia chart has been revised I’m confident that Bezos and his Ecuador’s Deputy Foreign Minister significantly since I served, the mili- Amazon leadership team knew quite discussed the possibility of Assange tary brass doesn’t consider a private, well that pulling the hosting service taking residence there, but the coun- most especially one barely beyond his served no useful purpose. My hunch try’s president puts the kibosh on teenage years, to be a bulwark of reli- is that this was viewed as purely a that idea for the same reason. Unfor- ability and sound judgment. business decision—they didn’t need tunately, there aren’t many asylum The operative question is, “By the distractions from congressional what authority were Manning and his complainers and watchdogs, and cohorts given access to sensitive, clas- they certainly wanted to avoid guilt Security clearances were sified government documents?” I’ve by association with the controversial never intended to be asked this question of every senior WikiLeaks. issued carte blanche. military officer that I know, and have Within a few hours after Every- yet to find anyone who even claims DNS removed the authoritative DNS to know the answer. In my day, a records for the WikiLeaks.org site military security clearance wasn’t a hosted by Amazon Web Services, candidates among the dozen or so hunting permit for curiosity seekers. WikiLeaks defiantly announced on countries that don’t have extradition One relevant data point is Donald the creation of WikiLeaks.ch. treaties with the US. Rumsfeld’s desire to encourage infor- That domain resolved to an IP But the computing and IT compo- mation sharing between and within address that is part of a small class-B nent is just a small part of this story. military agencies while he was Sec- network cluster, not in Switzerland The part of the story that has been retary of Defense under George W. but in Sweden, where, ironically, underreported so far has to do with Bush. It’s likely that this created the Julian Assange had an outstand- the rest of the people involved—the climate that made it possible for low- ing arrest warrant for alleged sex many nameless who remain in the level enlisted military personnel like offenses. (You can’t make this stuff shadows, an ensemble of colorful Manning to access sensitive informa- up, folks!) actors cast against the background tion that was either beyond the scope The Swedish server in turn redi- of a much larger group of powerful of his job or, under the most charita- rected traffic to a French host, which politicians and military brass who, ble interpretation, marginally related. assigned an IP address that was part by most accounts, aren’t the sharpest This is a good time for everyone to of a 16-address server cluster located knives in the drawer. be reminded that security clearances in France but registered in Melbourne, are like college diplomas—they affirm Australia. Of course, the WikiLeaks THE UNTOLD STORY that the individual has satisfied some team was parallel processing all the At this writing, Julian Assange is minimal standards appropriate to while, so there were multiple threads fighting extradition to Sweden, living the imprimatur. Neither attests to an operating simultaneously. If you’re in an English manor, and soliciting individual’s sagacity or capacity to beginning to feel that getting hold of donations on the WikiLeaks site to contribute anything important to the WikiLeaks content on the Internet help with his legal defense. Private world. They are best thought of as one is like trying to shovel smoke into a Manning has been detained since filter among many. bucket, you’re getting the big picture. May 2010 in military jails in Kuwait Security clearances were never Meanwhile, back in Congress, US and Quantico, Virginia, under condi- intended to be issued carte blanche. Senator Dianne Feinstein, chair of tions that have drawn criticism from Standard operating procedures the Select Committee on Intelligence, a variety of sympathizers, includ- always circumscribe their use on a and vice-chair Christopher Bond ing Amnesty International. He is need-to-know basis. The fact that an requested that Attorney General Eric currently incarcerated at Fort Leav- individual has been deemed trust- Holder prosecute Julian Assange (to enworth, Kansas, awaiting trial facing worthy by a vetting process is just my knowledge, the justification was a courts marshal under Article 32 of the first step in a reasonable autho- somewhat hazy). At about the same the Uniform Code of Military Justice. rization process. Having the requisite

88 computer clearance should not entitle the holder perfectly reasonable sense in which • Perhaps access to internationally to access all information classified at the secret documents were an attrac- sensitive diplomatic information a level commensurate with the clear- tive nuisance to someone like Private should be reserved to policy- ance. The second step determines Manning. makers and diplomats who whether the holder has a “need to While I agree that someone actually have a need to know know” based on his military occupa- should take responsibility for the this information. There’s a news tional specialty code and rank. In this WikiLeaks fiasco, it’s someone much flash. context, the “impact of disclosure” is farther up in the organization chart • Information security policy has always taken as a critical consider- than Manning. Here’s a news flash to make sense and be enforced. ation in this determination. for our military: kids and young Maybe WikiLeaks and Private At the time Manning is alleged adults sometimes do dumb things. Manning should be considered to have leaked this information, Don’t trust them with the keys to the change agents? protocols for determining confiden- kingdom. tiality levels, data integrity levels, In plain terms, any reasonable, and availability level had already DID THIS WIKILEAKS STORY security-aware person either already become law in the E-Government TEACH US ANYTHING? knew or should have known every- Act of 2002. Title III of this act, The There are so many characters, sub- thing this lesson has taught us. This Federal Information Security Manage- plots, and scene changes at this point is really a confirming instance of ment Act (FISMA), mandated that the that it will take years to really appre- policymakers and government offi- National Institute of Standards and ciate this security drama. cials who were asleep at the wheel. Technology create such standards, But what, if anything, have we If there’s anyone who deserved to sit which became Federal Information learned? in a jail cell over this, it’s someone Processing Standard (FIPS) 199 in further up in the food chain than an February 2004—five years before • It’s easy to steal information— Army private. the WikiLeaks disclosures. President especially when it’s electronic. Bush’s Executive Order (EO) 13292 Hadn’t anyone in the military specifically included military plans, chain of command heard of Nap- nfortunately, our mili- weapons systems, operations, foreign ster? They should have seen this tary leadership doesn’t government information, intelligence one coming. Useem to be very quick on activities (including special activities), • Innocuous “little people”’ can the uptake. As this column goes intelligence sources or methods, and create real problems for govern- to press, the Army has placed an foreign relations. ments: Daniel Ellsberg, David entire 100-member company from If Manning’s case goes to trial, his Koresh, Osama bin Laden—no the 4th Stryker Brigade at Joint Base attorneys will have a field day with the big shake-up here. Lewis-McChord, Washington, under issue of why the US government didn’t • It’s easier to steal something than lockdown because of the apparent follow its own information security to detect that it’s being stolen? theft of expensive military equip- guidelines when it allowed him to That one was easy. ment—another example of closing the rummage through secret information. • It’s hard to keep secrets. Ben corral after the cattle have escaped. There’s another issue involved as Franklin said it all: “Two people Is it possible that the real problem well—admittedly a social issue rather can keep a secret if one of them behind this theft was attractive temp- than a legal one. Why would any rea- is dead.” tation without adequate oversight—in sonable authority put a disputatious • Be careful whom you trust. the same spirit as WikiLeaks and the Army private in front of a computer Consider Judas, Guy Fawkes, matter of Private Manning? terminal that can access controver- Benedict Arnold, Gavrilo Prin- sial, contentious, embarrassing, or cip, Kim Philby, Aldrich Ames, Acknowledgment: Many thanks to Jim libelous information with interna- Robert Hanssen, …. Earl for his insights. tional implications? • Be careful what information you There’s a familiar staple in case retain and share. Think Enron, Hal Berghel, Out of Band column editor, law called the attractive nuisance Arthur Anderson, and the shred- is a professor of computer science at doctrine that holds that a landowner ding party that ensued in the the University of Nevada, Las Vegas, who presents curiosities to those midst of a recent US Justice where he is the director of the Identity who aren’t fully capable of under- Department investigation. The Theft and Financial Fraud Research and standing the risks involved may be cat has been out of this bag since Operations Center (itffroc.org). Contact held liable for damages. There’s a the invention of the bag. him at [email protected].

MARCH 2012 89