IP: CIA Director Deutch and MLS from Risks Digest 20.78

[Dave Farber <farber () cis upenn edu>]

> Date: Tue, 1 Feb 2000 09:40:14 -0500 (EST)
> From: Jeremy Epstein <jepstein () monumental com>
> Subject: CIA Director Deutch and MLS
>
> An article in *The New York Times* 1 Feb 2000 details former CIA Director
> Deutch's use of unclassified Macintosh computers in his homes to store
> thousands of highly classified documents on the same computer he used to
> access AOL, Citibank's personal banking service, and other services.  The
> investigation seems to have been delayed and perhaps limited as a result of
> Deutch's position.
>
> It's old hat that personal computers (be they Windows, Macintosh, or
> UNIX-based) are inherently unsuitable for Multi-Level Security (MLS).  What
> we see here is that even though all the proper procedures were in place, the
> human element is sufficient to undermine all of the technical controls.  As
> long as we have people, we'll have RISKS!
>
> Full article at
> http://www.nytimes.com/yr/mo/day/news/washpol/cia-impeach-deutch.html
>
>   [Multilevel security may not seem to be an issue here *internally*
>   because John Deutch had access to all of the information on his
>   systems, considered as SYSTEM HIGH -- that is all logically at the
>   highest level.  However, surfing the (unclassified) Web is clearly a NO-NO
>   from such a machine.  RISKS readers are of course familiar with the risks
>   of Web browsing.  However, an added note in this case was the report that
>   the visited sites included a porn site.  Deutch apparently denied having
>   accessed porn any sites, suggesting that it might have been done by one of
>   his offspring?  If that is indeed true, it would make the presence of
>   highly classified information on a multiuser workstation even more
>   untenable.  (On one hand, even if such a PC claimed to be multilevel
>   secure, that would be a VERY BAD misuse.  On the other hand, RISKS readers
>   know how one can be duped into visiting sites other than what was
>   expected, as in clicking on whitehouse.com instead of whitehouse.gov,
>   or in clicking on a Trojan-horsed URL.)  PGN]