2003 IMTA Proceedings - International Military Testing Association

The most significant event of this type is that of the compromise of a highly
sensitive but unclassified Air Force aircraft maintenance and inventory database that took
place in 1996 (Caruso, 2003). 5 In December of that year, a system administrator at Wright
Patterson Air Force Base discovered a security breach in the operations side of the Air
Force Reliability and Maintainability Information System (REMIS) that tracks all aircraft
and weapon systems. The breach was soon traced to Zhangyi “Steven” Liu, a subcontractor
employee, one of 11 young Chinese nationals who had recently been brought
over to work on the software development side of the database system. Somehow Liu
was able to access a “super super password file” that gave him access to the operational
database and the power to change or delete any file in the system. He and two other
coworkers proceeded to download unauthorized files to a personal directory that could
have been accessed by Internet users. It was never established whether these data were
transmitted outside the country or what his true motivations were in breaking into the
system. The prime contractor was forced to spend $350,000 to examine the code and
database to ensure that no malicious code had been installed by Liu or his coworkers.
In March, 1997, Liu pleaded guilty to two counts of gaining illegal access to the
$148 million REMIS. He later withdrew his plea and was found guilty on two
misdemeanor counts by a jury. He received a sentence of 4 months confinement, 1 year
of supervised work-release and a fine of $4,000 (“Chinese national,” 2000).
Summary and Conclusions
The following conclusions are based on the analysis of information in the Insider
Database and case studies described above. These have been reinforced by a parallel
study of insider events in the private sector sponsored by PERSEREC that has provided a
number of additional insights into the patterns of activity associated with these attacks on
sensitive information technology resources. 6
• Technical security measures offer minimal protection from abuse when the
offender is a systems administration or has some level of administrative access
to the system.
• Interpersonal relations within the workplace and the organization’s climate are
very important for understanding IT systems misuse. In almost a quarter of the
cases there was evidence of prior hostility in the workplace involving the
offender and usually a supervisor.
• Some of these events could have been avoided by better security education.
Personnel need to know what the rules are concerning the use of the system,
what is acceptable and not acceptable use of that system, and what the
consequences are for stepping over the line.
• Both enhanced personnel security and technical deterrents should be applied to
minimize the threat posed by angry or indifferent personnel who have legitimate
access to defense information systems.
5 This case summary is based on information contained in a recent thesis by Lt. Valerie L. Caruso
at the Air Force Institute of Technology and on media reports of that time.
6 Undertaking this project for PERSEREC is Dr. Eric Shaw, Consulting & Clinical Psychology,
Ltd. Shaw is focusing on prosecuted cases in which an insider has attacked a corporate system
that is related to the critical national infrastructure. A report on this work is forthcoming in 2004.
295
45 th Annual Conference of the International Military Testing Association
Pensacola, Florida, 3-6 November 2003