The Swedish Defense Ministry got an intel
scare recently when an officer put some classified documents on a USB memory
stick, inserted said device into a PC at an Internet Café, and then left
without taking the device with him. A citizen discovered the stick, realized
what was on it, and turned it over to a local newspaper, which it turn passed
it on to the Defense Ministry. There,
the counter-intelligence people had a fit.
Counter-intelligence officials, whose
job it is to prevent secrets from being stolen, are not happy with memory
sticks, which have basically replaced 3.5 inch floppy disk and rewritable CDs
as the favored way of carrying around computer information. These devices are
small, and easily misplaced, or stolen. In Afghanistan, and to a lesser extent
Iraq, cleaning and maintenance staff, have a an annoying tendency to steal
whatever they can get away with. For security reasons, many of the cleaning
personnel in Iraq are imported non-Iraqis. These people are less likely to
steal, not just because they have a harder time fencing the stuff, but because
they can lose a good job, and be shipped home, if they get caught. In
Afghanistan, hiring locals is less of a security risk, and there it has been
discovered that memory sticks are very popular items to steal. Some of these
devices are as small as a finger, and easy to conceal. Out on the street, some
of them can bring five or ten bucks to the thief. That's real money in
Afghanistan, where a good monthly salary is a hundred dollars.
The memory sticks generally hold between 512
megabytes (million bytes) to four gigabytes (billion bytes) of data. These
items plug into most PCs and laptops, and instantly become another hard drive
(as far as the computer is concerned.) Troops like them because they can quickly
put all the data they need for a mission on a memory stick. The memory sticks
are cheap, four gigabyte one versions can be had for under a hundred dollars,
the smallest capacity ones for twenty bucks or less. The troops leave a lot of
them lying about, and many of these get swept up by the friendly Afghan
cleaning guys. When the purloined memory sticks show up in the market place,
their contents, sometimes including classified data, are usually erased, to
make way for the new users stuff. But, for a counter-intelligence officer, the
vulnerability is obvious. The nightmare scenario is a journalist getting
possession of one of these stolen memory sticks. The resulting story would
feature as many damaging secrets as possible.
But it gets worse. As it turns out,
these "Memory Sticks" fit nicely on the dog tag chain. Troops keep
their email from home, digital pictures and all manner of stuff on these small
devices. Some officers have tied to forbid the practice, as you are not
supposed to take such documents with you into a combat zone (lest you be
captured and the data prove useful to the enemy.) But the troops still carry
the memory sticks around with them.
For official use, the military is
beginning to issue encrypted (and more expensive) memory sticks. But there's
still the growing risk of classified data getting on to an unencrypted device.
Every new technology brings with it new risks, and this is a perfect example.
But there are also opportunities, as the terrorists also like to schlep data
around on memory sticks. It takes time to find the useful secrets, though, as
you first have to plow through all the porn and MP3 files.