Tuesday, January 27, 2009

Confidential MP3 Player: Been There, Done That, Did Not Burn After Reading

Due to a personal experience involving the terror of missing classified data, I had to look at this CNN video about a New Zealand man purchasing a second-hand MP3 player and discovering it had confidential U.S. military files on it. Unlike the comic situation with what looks like secret files in the movie Burn After Reading, trailer above, the files the New Zealander found on his MP3 were real, having the social security numbers of U.S. soldiers and deployment information:
Chris Ogle of New Zealand was in Oklahoma about a year ago when he bought a used MP3 player from a thrift store for $9. A few weeks ago, he plugged it into his computer to download a song, and he instead discovered confidential U.S. military files.

"The more I look at it, the more I see, and the less I think I should be," Ogle said with a nervous laugh in an interview with TVNZ.

The files included the home addresses, Social Security numbers and cell phone numbers of U.S. soldiers. The player also included what appeared to be mission briefings and lists of equipment deployed to hot spots in Afghanistan and Iraq. Most of the information appears to date to 2005. (CNN)
Here's the video about how the man found the confidential information on his MP3 player.

PC World says this is not the first time something like this happened.
A similar situation was uncovered in Afghanistan in 2006 when U.S. investigators bought stolen flash drives with military information outside Bagram base--a major U.S. military outpost in Afghanistan.

In November 2008, the U.S. Department of Defense banned the use of USB storage devices to prevent leaks like this from happening again. This was shortly after DoD computers were infected with a worm capable of downloading malware onto the Department's computers. The McCain 2008 campaign also experienced a similar issue when a reporter purchased a Blackberry at the campaign's fire sale that contained secure information. (PC World)
Both the PC World story and the reporter in CNN video says that these kinds of security leaks are increasing in the digital age. That may be true, but when I was married, the world was far less digital and my husband at the time, who worked for a defense contractor on the east coast, moved a box of classified papers out of the car to make room for something else. I don't remember what. Absent-minded as he was sometimes, once he had rearranged the car he hopped in and drove off.

When he arrived home ready to work, he realized what he'd done. Panic city because he was sure he'd lose his job. We drove back to the parking lot, praying all the way. Got there, no box.

This is where the story gets weird and I know some people won't believe it or will chalk it up to coincidence and ordinary good fortune. We went home and had a serious prayer fest (Sadly, I don't pray as much as I once did. Must improve.) Recalling the scripture that we should go boldly before the throne of grace, I said, "God, I want that box on our doorstep by tomorrow morning." And I fully expected to see it. It's easier to have that kind of faith when you're young.

About an hour later, the phone rang. A man asked for my husband. He and his wife had found the box, and the home phone number had been on a note in the box. That was odd since it was not a personal box. The man and his wife delivered the package shortly after that.

No need to worry that my absent-minded ex is out there still working with sensitive military information. He works in a different industry today.

A similar situation happened to one of his co-workers, however, a year later. The man went on a business trip. Got lost, and got out of the car, a rental, to make a phone call. His briefcase was unlocked and in the car, to which he'd left the door ajar. Yes, his briefcase contained confidential government information, mostly fiscal, as confidential as it can be between the government and a major defense contractor.

While he was on the phone, a thief slipped into the rental car door and sped away in the car with the papers, which were never retrieved. I can't remember if the guy was fired or not. Fortunately, an ordinary thief probably didn't know what to do with the data. He only wanted the car.

When I worked at a government nuclear facility years ago, I didn't want a high level clearance. Probably couldn't have gotten it anyway. But didn't want the pressure of knowing what we were really up to in the labs. I love plausible deniability.

This MP3 thing is not funny. What if the man who bought the MP3 player was hostile to the United States. Whew!

No comments: