FBI Wants More Access To Everything, Can’t Be Bothered To Protect The Stuff It Already Has

Failures

from the bringing-down-a-nation-by-visiting-a-recycling-center dept

The FBI has been pulled right up to the national security table for years. Having switched from regular law enforcement agency to being a major player in the counter-terrorism field has seen it avail itself of vast collections of data obtained by the NSA. While its own contributions to combating terrorism have been questionable at best, only recently was its access to NSA data seriously challenged.

But nothing came of that and things go on as they have for the past two decades. As if that wasn’t enough, the FBI’s directors constantly complain about encryption getting in the way of slurping up communications and scraping seized phones of all their data.

Well, all of the stuff the FBI currently collects, obtains, or has access to has to be stored somewhere. And it wants to add to these haystacks. But when the haystacks needs to be rotated out due to device failure or hardware updates, the FBI apparently believes no precautions should be taken to make sure classified and sensitive data doesn’t end up in the hands of others.

That’s what DOJ Inspector General Michael Horowitz has highlighted in his recent memo to the agency, which points out its extremely careless handling of discarded computer hardware.

We found the FBI does not always account for its loose electronic storage media, including hard drives that were extracted from computers and servers, thumb drives, and floppy disks. For example, the FBI instructs field offices to remove hard drives slated for destruction from Top Secret computers to be couriered separately to save on shipping costs. However, extracted internal hard drives are not tracked, and the FBI does not have the ability to confirm that these hard drives that contained SBU and/or NSI information were properly destroyed. The lack of accountability of these media increases the risk of loss or theft without possibility of detection.

Not great! There are small companies that handle device and data destruction more responsibly than this and their overriding concern is maintaining market share, rather than, say, securing a nation.

The FBI also handles classified data almost as carelessly as a former president. While servers and drives might be marked to indicate the presence of classified or top secret data, data extracted for disposal is placed on other devices that do not bear these markings, making it that much easier for top secret data to be treated as carelessly as trash from the office break room.

On top of that, the FBI tends to take its time destroying hardware, which results in warehouses full of components that are potentially full of extremely sensitive information. This long-term storage is overseen by… nobody.

Non-accountable assets slated for destruction were stored on pallets without sufficient internal physical security for an extended period of time. For example, a pallet containing extracted internal hard drives marked non-accountable had been stored for 21 months and had wrapping that was torn and left open. This facility is shared with other FBI operations, such as logistics, mail, and information technology equipment fulfilment, and had almost 400 persons with access as of May 2024, including 28 task force officers and 63 contractors from at least 17 companies. Both the FBI supervisor and contractor confirmed that they would not be aware if someone was to take hard drives from the pallets because these assets are not accounted for or tracked.

I’m tempted to believe “non-accountable assets” is a reference to FBI employees. But even if it’s meant to designate devices that most likely do not contain classified or top secret information, there’s no way the FBI itself can say for sure because of the previous two problems the IG discovered: top secret/classified info isn’t always accounted for and some devices containing sensitive info get placed on the “please destroy” pile without proper external labeling.

Ignoring every requirement along the way to destruction results in stuff like this, which doesn’t exactly instill confidence in the FBI’s ability to stay on task, be detail-oriented, or many other basic levels of competency one would hope to find in the nation’s largest law enforcement agency.

Walmart takes more care securing its Black Friday pallets than the FBI does with its pallets full of sensitive info. Keep that in mind the next time the FBI’s complaining it simply doesn’t have enough access to data or top secret information. It doesn’t secure what it already has. It definitely shouldn’t be entrusted with anything more until it can handle this very basic part of internal security.

Filed Under: classified documents, doj, fbi, inspector general