Wikileaks causes 'need to know' pendulum to swing again

Ira Winkler says security needs to practice consistent, measured incident response to avoid extreme policies and predictable overreactions

By Ira Winkler

December 13, 2010 — CSO —

If you are in the security profession long enough, you realize that security policies are generally a pendulum that you have to live with. While the recent Wikileaks incident will cause information sharing within the Department of Defense and US Government as a whole to swing back the other way, you can bet that in a few years, it will swing back to wholesale information sharing again. Like many aspects of the world, security practices are—unfortunately—driven by the most recent events.

In the case of Wikileaks, it is generally assumed that a low level intelligence analyst stationed in a remote base in Iraq, Bradley Manning, surfed around a classified military network and downloaded all the data that he could. He then transferred all the data onto a USB drive that he was given permission to attach to the network, so he could listen to music. He then took the USB drive to a computer connected to the Internet, and sent the classified data to Wikileaks. Now, of course everyone is outraged that anyone had access to all of that classified data when they clearly didn't need it. I am going to avoid going into my personal thoughts about the Wikileaks and Manning, but the implications for security professionals are important to understand.

First let's consider some of the findings resulting from the 9/11 attacks. There was of course outrage that the CIA and FBI were not sharing information. There were likewise many other pieces of information that were not shared among intelligence agencies, including for example some information that the Department of State had available. The 9/11 Commission cataloged a lot of this, and in response, the Department of Defense and intelligence agencies decided that they want to make information more available. This led to the creation of one big network that everyone with a Secret clearance apparently had access to across the US Government—including an Army private located in the middle of nowhere with very limited responsibilities.

I am clearly oversimplifying the issue, but that is what it really boils down to.

The pre-9/11 lack of information sharing was described to be dangerous, and in response everyone ignored the previous incidents that created the withholding of information in the first place.

For example, there was the case of Jonathan Pollard, a Naval intelligence analyst who gave sensitive information to Israel. This was before there was a lot of computer connectivity, so he would visit other intelligence agencies to look for information. There were several other similar incidents as well. Therefore, the need to know was strictly enforced. Again, the 9/11 incidents swung the pendulum far over towards the other end.

• Print