Monthly Archives: March 2024

A version of this story appeared in the daily Threat Status newsletter from The Washington Times. Click here to receive Threat Status delivered directly to your inbox each weekday.

The National Security Agency fears a quantum computing breakthrough by Americas adversaries would jeopardize the security of the global economy and allow foes to peer inside top-secret communications systems.

The agencys concern is that an unforeseen advance in quantum technology would crack encryption systems used to protect everything from financial transactions to sensitive communications involving nuclear weapons, according to NSA Director of Research Gil Herrera.

Speaking at an Intelligence and National Security Alliance event last week, Mr. Herrera said no country has a quantum computer that he would consider useful yet.

He said there are a lot of teams around the world building with different technologies and someone could achieve a development representing a black swan event, an extremely unexpected occurrence with profound and dangerous consequences for U.S. national security.

If this black swan event happens, then were really screwed, Mr. Herrera said.

Americans could suffer consequences from such a quantum leap in several ways. Mr. Herrera said the world economy, and the U.S. market in particular, are vulnerable because most financial transactions are secured by encryption systems that cant be cracked by non-quantum means.

If quantum tech weakens or eliminates such encryption walls, then financial institutions may have to resort to older transaction methods and banks would look for other means to protect their dealings with other banks, according to Mr. Herrera.

And, he warned, other industries may be even less resilient in the face of the threat. Mr. Herrera said the threat of a quantum computer is not limited to its immediate potential damage, but to the fallout from obtaining encrypted information that was previously recorded.

Drawing on his decades of experience at Sandia National Laboratories, Mr. Herrera said a quantum advance may be able to help people find information on weapons systems that have been in the U.S. arsenal for a significant period of time.

There are ways that we can communicate with our various partners in nuclear weapon production where public key encryption is utilized to share keys, Mr. Herrera said. And now, what if somebodys recorded that information and they crack it?

Details on foreign adversaries advanced computing capabilities are closely guarded, Federal policymakers are worried in particular about Chinas efforts to achieve computing breakthroughs.

Reflecting on supercomputers at a House Armed Services Committee hearing last year, Rep. Morgan Luttrell said he worried Beijing may have already surpassed the U.S. in its supercomputing prowess.

China should have on board or online another computer that would have trumped us and pushed us back some, the Texas Republican said at the March 2023 hearing. So the amount of money theyre spending in that space as compared to us would make me think that theyre ahead of us.

Retired Gen. Paul Nakasone, then in charge of U.S. Cyber Command, cautioned Mr. Luttrell against assuming that outspending America would guarantee an adversarys technological success.

Spending money doesnt necessarily mean that youre the best in what you do and being able to integrate that kind of capability is what really matters, Gen. Nakasone said at the hearing. So being able to take the intelligence, integrate it within maneuver force to have an outcome is where I clearly see United States has the lead.

But experts agree that quantum computing breakthroughs would dramatically outdo existing supercomputers. The NSA is not waiting to find out.

Mr. Herrera said the NSA believes the algorithms it is deploying will withstand a quantum attack.

One thing NSA has done about it is we actually started research in quantum-resistant algorithms not too long after we started funding academic programs to come up with what a quantum computer would look like, Mr. Herrera said. So we have a lot of maturity within the NSA, we have been deploying quantum-resistant encryption in certain key national security applications for a while now.

Efforts to better understand the quantum capabilities of Americas adversaries are underway as well. The congressionally chartered U.S.-China Economic and Security Review Commission is scrutinizing the communist countrys push to transform its military through the application of quantum and emerging technologies to its weapons systems and logistics.

Last month, the commission conducted a hearing that included an examination of Chinas quest for teleportation technology.

Read the original here:
NSA fears quantum computing surprise: 'If this black swan event happens, then we're really screwed' - Washington Times

Electrical engineer Gilbert Herrera was appointed research director of the US National Security Agency in late 2021, just as an AI revolution was brewing inside the US tech industry.

The NSA, sometimes jokingly said to stand for No Such Agency, has long hired top math and computer science talent. Its technical leaders have been early and avid users of advanced computing and AI. And yet when Herrera spoke with me by phone about the implications of the latest AI boom from NSA headquarters in Fort Meade, Maryland, it seemed that, like many others, the agency has been stunned by the recent success of the large language models behind ChatGPT and other hit AI products. The conversation has been lightly edited for clarity and length.

Gilbert HerreraCourtesy of National Security Agency

How big of a surprise was the ChatGPT moment to the NSA?

Oh, I thought your first question was going to be what did the NSA learn from the Ark of the Covenant? Thats been a recurring one since about 1939. Id love to tell you, but I cant.

What I think everybody learned from the ChatGPT moment is that if you throw enough data and enough computing resources at AI, these emergent properties appear.

The NSA really views artificial intelligence as at the frontier of a long history of using automation to perform our missions with computing. AI has long been viewed as ways that we could operate smarter and faster and at scale. And so we've been involved in research leading to this moment for well over 20 years.

Large language models have been around long before generative pretrained (GPT) models. But this ChatGPT momentonce you could ask it to write a joke, or once you can engage in a conversationthat really differentiates it from other work that we and others have done.

The NSA and its counterparts among US allies have occasionally developed important technologies before anyone else but kept it a secret, like public key cryptography in the 1970s. Did the same thing perhaps happen with large language models?

At the NSA we couldnt have created these big transformer models, because we could not use the data. We cannot use US citizens data. Another thing is the budget. I listened to a podcast where someone shared a Microsoft earnings call, and they said they were spending $10 billion a quarter on platform costs. [The total US intelligence budget in 2023 was $100 billion.]

It really has to be people that have enough money for capital investment that is tens of billions and [who] have access to the kind of data that can produce these emergent properties. And so it really is the hyperscalers [largest cloud companies] and potentially governments that don't care about personal privacy, don't have to follow personal privacy laws, and don't have an issue with stealing data. And Ill leave it to your imagination as to who that may be.

Doesnt that put the NSAand the United Statesat a disadvantage in intelligence gathering and processing?

II'll push back a little bit: It doesn't put us at a big disadvantage. We kind of need to work around it, and Ill come to that.

It's not a huge disadvantage for our responsibility, which is dealing with nation-state targets. If you look at other applications, it may make it more difficult for some of our colleagues that deal with domestic intelligence. But the intelligence community is going to need to find a path to using commercial language models and respecting privacy and personal liberties. [The NSA is prohibited from collecting domestic intelligence, although multiple whistleblowers have warned that it does scoop up US data.]

See the original post here:
The NSA Warns That US Adversaries Free to Mine Private Data May Have an AI Edge - WIRED

Organizations across all industries experienced a surge of ransomware attacks last year as cybercriminals extracted $1.1 billion in payments from victims. To thwart these bad actors and improve network security, the National Security Agency (NSA) released a new cybersecurity information sheet: Advancing Zero-Trust Maturity Throughout the Network and Environment Pillar.

As the creator of zero-trust, Im pleased to see the NSAs document emphasizes a paramount, yet frequently overlooked element of zero-trust security: segmentation.

I have long advocated that segmentation stands as the fundamental essence of zero-trust. However, in recent years, there has been a noticeable tilt toward the Identity pillar of zero-trust, leaving network security controls vulnerable both on-premises and in the cloud.

As the attack surface expands and the digital landscape grows increasingly interconnected, segmentation of on-premise networks, cloud, multi-cloud, and hybrid environments becomes imperative for organizations to fortify resilience and establish enduring zero-trust architectures.

The NSA also recognizes the importance of "data flow mapping." Flow mapping has been a focal point of my zero-trust advocacy since its early days. Understanding system interconnections is essential for successfully architecting zero-trust environments.

NSAs document also underscores the significance of network security technologies in establishing a zero-trust environment. Organizations, whether on-premise or in various cloud environments have largely overlooked the importance of network security controls. I think of network security as the cornerstone of zero-trust, particularly in combating ransomware attacks that jeopardize essential services and disrupt everyday life.

The NSA has reaffirmed this pivotal role of network security, finally granting zero-trust segmentation (ZTS) the recognition it deserves. This guidance should help organizations comprehend the importance of the Network pillar within zero-trust and encourage them to pursue network security technologies as they progress toward implementing a zero-trust architecture.

As global connectivity grows, the attack surface expands. Thats why its imperative for organizations to delineate, map, and fortify their most critical Protect Surfaces within their zero-trust environments.

I hope the NSAs recommendations convince more organizations to implement zero-trust as they cope with the ever-changing cybersecurity landscape. These zero-trust principles have become mainstream across various industries and organizations of different sizes. As cyber threats evolve, more companies will recognize the need to implement a zero-trust approach to protect their digital assets.

Here are my recommendations for how to implement zero-trust effectively:

I commend the NSA for issuing its latest guidance because its a significant endorsement of the effectiveness and significance of ZTS, offering invaluable guidance for organizations seeking to fortify their cyber resilience amid the ever-changing threat landscape. Its impossible to prevent all cyberattacks, but implementing a zero-trust model will significantly reduce the potential damage and strengthen any organizations security posture.

John Kindervag, chief evangelist, Illumio

See original here:
Five ways to implement zero-trust based on NSA's latest guidance - SC Media

An Air Force intelligence analyst is alleged to have shared classified U.S. intelligence on the chat platform Discord with followers of an anti-government extremist group, according to an FBI affidavit that was unsealed this week.

Investigators said that analyst Jason Gray shared information that he likely obtained from his access to National Security Agency intelligence while he served at a base in Alaska, according to the affidavit, which was dated November 2022 and accompanied a search warrant for a Discord account that Gray said he operated.

At the time the FBI sought the warrant, Gray had already admitted to Air Force investigators that he had created a Facebook group for supporters of the loosely organized, anti-government Boogaloo movement, whose followers anticipate a second U.S. civil war. Gray, whom investigators described as unhappy with his military career, participated in several pro-Boogaloo Discord channels and shared the classified NSA intelligence with seven other individuals, possibly in furtherance of the Boogaloo ideology, the affidavit stated.

Grays case bears striking similarities to another leak of highly classified intelligence on Discord by an Air Force National Guard member, Jack Teixeira, who worked in an intelligence unit in Massachusetts that is similar to the one in which Gray worked in Alaska. Both men were in their 20s, active on Discord, espoused anti-government views and had access to huge amounts of classified information given the nature of their jobs. Teixeira also harbored conspiracy theories about law enforcement and joked with friends about killing federal agents.

Teixeira was a computer support technician who copied large amounts of classified material and shared it with friends on the Discord platform from 2022 until 2023. Subsequent investigations have shown that military officials had no idea Teixeira was removing classified information from the sensitive facility where he worked at Otis Air National Guard Base in Cape Cod, Mass. His leaks only came to public attention when classified documents that he had shared with friends began spreading across the internet in early 2023.

Teixeira has pleaded guilty and is expected to receive a prison sentence of 11 to 16 years in the wake of what officials describe as one of the biggest leaks of classified information in a decade.

It wasnt immediately clear if investigators initially suspected Gray of sharing classified information on Discord when he consented to let them examine his account. But given that he had been discovered months before Teixeira was arrested, the incident raises questions about what the Defense Department knew about personnel who were able to share highly guarded government secrets on a chat platform.

An investigation by the Air Force inspector general found that Teixeiras supervisors knew he was looking at classified information that had nothing to do with his job and failed to stop him. Working late at night with practically no supervision, Teixeira was able to copy classified information by hand or print out documents and remove them from his workplace, the inspector general found.

Like Teixeira, Gray allegedly shared images on Discord showing firearms he possessed. A separate FBI affidavit stated that agents discovered photographs uploaded on Grays account that appeared to show guns equipped with silencer or destructive devices, including one that showed someone matching the appearance of Gray brandishing a firearm that appears to be equipped with a silencer. Federal law requires silencers and similar devices to be registered, but the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) had no record of Gray doing so, the affidavit said.

Teixeira was able to take advantage of Discords data retention policies, which automatically render most material impossible to recover upon deletion, to remove a record of some of his activity on the platform. It is unclear what if anything Gray deleted from Discord before authorities accessed his account.

It also was not immediately clear if the Air Force conducted an investigation into the security protocols at Joint Base Elmendorf-Richardson, in Anchorage, where Gray was assigned and worked for an office of the National Security Agency, which collects electronic information and conducts computer network surveillance around the world.

Gray was never charged with sharing the classified information and appears to have disclosed far less than Teixeira. The FBI affidavit described the information only as an image that appeared to be classified. The affidavit does not say whether the suspected classified information was originally contained in an image that Gray uploaded, or if Gray photographed it himself and subsequently shared it.

Based on court records, in the course of investigating Gray for possession of classified material, authorities discovered a large amount of child pornography on his personal devices. He pleaded guilty to distributing child pornography and received a 60-month prison sentence.

Officials at the Alaska air base didnt respond to a request for comment. A public defender who represented Gray declined to comment. Grays plea agreement with the Justice Department doesnt indicate whether he faced potential charges at some point for leaking classified information.

A spokesperson for Discord said in a statement to The Washington Post that the company cooperated with the law enforcement investigation once notified, including by producing data that was lawfully requested.

The sharing of classified documents poses a significant, complex challenge for Discord as it does for any online platform, the statement continued, noting that only government personnel can determine what material is actually classified. And currently, there is no structured process for the government to communicate their determinations to online platforms.

Discord prohibits using the platform for illegal activity, which includes the unauthorized disclosure of classified documents, the statement added.

The Boogaloo ideology allegedly embraced by Gray has fueled a string of crimes, including the murder by a former Air Force Sergeant of a guard at a federal courthouse in Oakland, Calif. In June 2020, Facebook banned hundreds of accounts, pages and groups associated with the movement. The same month, Discord banned a large server affiliated with Boogaloo adherents following a report by VICE News.

Grays Facebook group was one of several that adopted the names and logos of news outlets, part of the movements trolling campaign against journalists and the mainstream media, but presumably also a way to disguise the groups activities from content monitors.

The private group, called CNN Journalist Support Group, first appeared after Facebooks June ban, and contained about 2,200 members, according to screenshots recorded by researchers with the Tech Transparency Project. Katie Paul, director of the TTP, said that in the summer of 2020 the organization sent the FBI records it had documented from the group.

This is an extremist movement that was born online and facilitated the behavior of otherwise lone wolfs, Paul said. Facebook was the central organizing hub, she said, but users also shifted conversations to other platforms, including Discord.

Grays former wife, Brieayna Geib, said she recalled his involvement with a Facebook group and the Boogaloo scene.

He was kicked off Facebook, she said.

Gray was assigned to the 301st Intelligence Squadron at Joint Base Elmendorf-Richardson in February 2021, according to court filings. He later told Air Force investigators that he grew disgruntled with his posting. Geib said she lived with Gray for part of the time he was stationed in Alaska. Gray first drew the attention of investigators in late 2022, Geib said.

In November 2022, the FBI searched Grays desktop computer, finding what appeared to be child sexual abuse images. A search of Grays phone showed he had exchanged child sexual abuse material with another user on the chat app Kik, according to a criminal complaint.

The Post reviewed messages that appeared under an account, notimeforlife, on a pornographic website. Some mentioned the same Kik account, donttacoboutit, that authorities alleged Gray used to share and discuss child sexual abuse material. The website hosts nonconsensual pornographic material, which victims have struggled to have removed, and posts with descriptions of rape and violent fantasies targeting women and girls.

Hannah Allam and Devlin Barrett contributed to this report.

Excerpt from:
Intel analyst shared classified information on Discord, investigators say - The Washington Post