The rampant technologists are at it again: “But Manning got access to a computer with a writable CD drive, and was able to copy all those classified documents to a CD (marked as containing Lady Gaga tracks) and walk out of his workplace with it. The big error here was having PCs available with writable media (USB ports, diskettes, printers or writable CD drives). You need some PCs with these devices, but they should be few, and carefully monitored. Normally, you would not need to copy anything off SIPRNet. Most of the time, if you want to share something, it’s with someone else on SIPRNet, so you can just email it to them, or tell them what it is so they can call it up themselves. A network like SIPRNet usually (in many corporations, and some government agencies) has software that monitors who accesses, and copies, documents, and reports any action that meets certain standards (of possibly being harmful). SIPRNet did not have these controls in place.”
A thousand times, “No.” If you rely on technology to be the gatkeeper, be prepared to be robbed completely blind. Technology fails. It’s part of what it does. That’s why human technicians, like me, exist–to stop the meltdowns and repair the damage done. And when technology is used to replace us, the meltdowns will be spectacular!
The correct answer to this situation is in two parts. First, correct acess levels. Just because we have this or that clearance doesn’t mean we should have access to everything that is cleared to that level. Most of the data that Manning got ahold of had nothing to do with his job–as such he should never have been able to access it without requesting it. A request to a human being who would evaluate the need and thus been aware of any patter of request that emerged.
Second, is proper document retention. Old stuff should be deleted or archived (moved to an even less accessible part of the system where it takes the same kind of request to get to as if it weren’t in your lane to begin with).
The common thread–human intervention–real brating people need to be engaged in these decisions and applying judgement to who can see what, much less copy it to a CD.