A Review of FBI Security Programs

More documents

Recommendations

Info

The security consequences of this policy are difficult to assess. Obviously, many cases previously restricted by default or designation are now open to the full universe of ACS users. Substantial sensitive source material is now unrestricted. For example, while informant and asset files remain restricted, it is likely that at least some of the other case files to which source information is attached are now unrestricted. While this new policy retained restrictions on tax and most grand jury information, other confidential information was not afforded continued protection. For instance, information collected pursuant to the Foreign Intelligence Surveillance Act (FISA) historically has been housed in restricted cases. There are complicated procedures – many driven by executive policy, but some predicated on case and constitutional law – governing the use of FISA information in criminal cases. Accordingly, problems may arise in making FISA information generally accessible throughout a system employed by agents conducting criminal investigations. 15 And a point more central to our mandate is again true: highly classified information has been made available to a range of Bureau personnel far broader than those who need to know it. Having implemented this decision, there is little the FBI can do to reverse it. For example, ACS does not have a separate case classification for investigations employing FISA information. Consequently, while a terrorism case (now unrestricted) might include FISA information, not all terrorism cases will. Therefore, it will be very difficult to identify all cases that include FISA information, particularly now that the information is generally available and may have been picked out for use in other (perhaps even criminal) cases. Even if the Bureau were to reinstate restrictions on certain existing cases, the case files have been generally available on ACS for some time; returning these cases to their previous security status has been likened to putting toothpaste back into a tube. Even if 15 On October 12, 2001, the FBI’s General Counsel ordered by Electronic Communication that FISA information newly uploaded onto ACS carry a warning about its source and declaring that the information cannot be used in criminal cases without approval from Headquarters and the Department of Justice. -48-
senior FBI officials responsible for this policy change considered all its implications before making it, they failed to solicit the input of key security personnel, whose views might have informed their decision. Although the change may be defensible, the manner in which it was made sends a clear signal that the FBI’s security organization is irrelevant during an operational crisis. TRILOGY The Bureau’s current effort to upgrade a number of its computer networks and systems reveals many of the inadequacies in its approach to information security. For the past several years, the FBI has requested that Congress appropriate funding to upgrade its computer systems, and upgrade proposals have evolved in response to Congressional concerns. In November 2000, Congress allocated $379 million for Trilogy, the most recent proposal. As the name implies, the Trilogy upgrade is composed of three parts. One component involves a substantial replacement of the Bureau’s telecommunications and network infrastructure. Another will implement a platform of products to make FBI computers more user friendly and to provide more centralized system management capabilities. The final component will upgrade some applications, such as the Automated Case Support system. Trilogy is not a comprehensive upgrade. A number of networks and systems will not be affected. Only the largest networks and most widely utilized systems will be improved. A senior Information Officer likened the Bureau’s existing systems to “an old car broken down in a ditch.” The purpose of Trilogy is to get the old car out of the ditch, not to provide the FBI with state-of-the-art information systems. Trilogy does present a considerable opportunity for security enhancement. For example, it contemplates a separation of the telecommunication backbones of the existing networks that could greatly improve their security. Intrusion detection technologies at the network level have also been considered to enhance the ability to monitor misconduct. The -49-
Page 1 and 2:
U.S. Department of Justice A Review
Page 3 and 4:
Commission for the Review of FBI Se
Page 5 and 6:
Contents Executive Summary ........
Page 7 and 8: The Commission for the Review of FB
Page 9 and 10: in FBI security programs that will
Page 11 and 12: Unlike other Intelligence Community
Page 13 and 14: INTRODUCTION I could have been a de
Page 15 and 16: un by an officer in the Soviet mili
Page 17 and 18: establishment, U.S. penetration of
Page 19 and 20: operatives he had exposed as double
Page 21 and 22: Hanssen was indicted on twenty-one
Page 23 and 24: een transferred to FBI Headquarters
Page 25 and 26: Gardens. The rebellious colonies di
Page 27 and 28: Furthermore, in spite of Hanssen’
Page 29 and 30: others.” In calling for the estab
Page 31 and 32: have discovered in FBI security pro
Page 33 and 34: The following is a compressed compi
Page 35 and 36: I. Security Investigations And Adju
Page 37 and 38: DOCUMENT SECURITY I. Classified Na
Page 39 and 40: of Central Intelligence Directives
Page 41 and 42: II. The Office of Security Should D
Page 43 and 44: INFORMATION SYSTEMS SECURITY (INFOS
Page 45 and 46: Robert Hanssen’s espionage demons
Page 47 and 48: een filled, the persons assigned of
Page 49 and 50: with the preliminary damage assessm
Page 51 and 52: FBI was investigating him. 13 While
Page 53 and 54: focus. 14 As a result of inadequate
Page 55 and 56: in unrestricted administrative case
Page 57: On October 3, 2001, an Electronic C
Page 61 and 62: percent of the amount sought. 16 Th
Page 63 and 64: information security policies that
Page 65 and 66: PERSONNEL SECURITY I think that [my
Page 67 and 68: The Commission conducted a detailed
Page 69 and 70: The PSU is also responsible for adm
Page 71 and 72: Unit for new applicants, the Person
Page 73 and 74: various elements is spread througho
Page 75 and 76: addressed. These interviews are ess
Page 77 and 78: identified, these individuals can b
Page 79 and 80: overextended and potentially at ris
Page 81 and 82: The FBI’s polygraph program was i
Page 83 and 84: awareness programs relating to poly
Page 85 and 86: DOCUMENT SECURITY Security was lax
Page 87 and 88: Much of Robert Hanssen’s espionag
Page 89 and 90: Room. In the same year, the FBI Mai
Page 91 and 92: Given the ubiquity of ACS, Headquar
Page 93 and 94: (SCI). Before being given access to
Page 95 and 96: eceived in the wake of recent terro
Page 97 and 98: under minimum security controls. Th
Page 99 and 100: carriers receive timely security cl
Page 101 and 102: with the true scope of improper act
Page 103 and 104: SECURITY STRUCTURE . . . [I]f I had
Page 105 and 106: In general, we found serious weakne
Page 107 and 108: executive will ensure constant focu
Page 109 and 110:
technical security countermeasures.
Page 111 and 112:
Eighty-five percent of those office
Page 113 and 114:
months training in investigations,
Page 115 and 116:
accounts cancelled. A six-hour secu
Page 117 and 118:
Unfortunately, reporting to securit
Page 119 and 120:
security violations should be subje
Page 121 and 122:
and training. -106-
Page 123 and 124:
Robert Hanssen’s treachery is hei
Page 125 and 126:
Glossary of Acronyms Acronym ACS AD
Page 127 and 128:
Acronym GSR HERU HIT HCS HQ HUMINT
Page 129 and 130:
Acronym OPM OPR OPSEC ORCON OSI OST
Page 131 and 132:
COMMISSION CHARTER
Page 133 and 134:
time equivalent government personne
Page 135 and 136:
WILLIAM H. WEBSTER, the Commission
show all

A Review of FBI Security Programs

Create successful ePaper yourself

Delete template?

Save as template?