Hacker Newsnew | past | comments | ask | show | jobs | submit | unknsldr's commentslogin

To #1, there's quite a bit of latitude so long as you aren't in uniform. You can, for example, participate in a rally on 'your time' so long as you do not endorse an ideology/candidate wearing your uniform. If speaking out against the Commander in Chief is taken seriously I suspect there would be a lot of violations (particularly surrounding DADT introduction and dissolution). There was in my unit mostly by senior NCOs and Warrants.

#3 Day job? I don't think there was any such sentiment around me. There are times when grooming standards are relaxed and affordances are made (drinking, for example). But if a soldier held the position that soldiering was a day job they'd be shown the light. Further, I'd like to hear from you regarding the AKO disclaimer that any device connected to the IS is subject to COMSEC monitoring, counterintelligence investigations, personnel misconduct (in particular), and so on. Your personal laptop is authorized for use with AKO. Should your personal laptop be found with Guardian content, as a soldier, you have committed a security violation. You mention in #2 about life becoming miserable. I'm sure you know how hard command can come down on you over a security violation. Linking to the Guardian (tweet, retweet, like, share) constitutes proliferation. In this case, you aren't being protected or helped here. The policy memo and official statement explicitly state that these blocks occur under preexisting filters designed to prevent accidental transfer of classified information to unclassified systems. In other words, the memo states command's classification of Guardian material as classified. I'm pretty certain they class it to the level of the leak. They can't classify by article or it would confirm/deny aspects of the leak. So they broadly classify the Guardian. As you state in #4, reading those documents, reading an article in public domain found on an unclassified system, will fall under UCMJ. Back to the idea of day job, you can't do this on your personal computer at a Starbucks on the weekend, either.

#4 The rules and regulations soldier agree to pertain to classified systems being inappropriate accessed. Soldiers know well the red banner versus the green banner. They don't know they are reading classified information on the Guardian until they are told they are. This is so far removed from what you depict that I do not believe it pertains.

#6 You can go straight to IG but your command won't appreciate not having the heads up. You can go to your congressperson but you had better work through your official channels first. You start with your chain of command. You complain about an overstep of information classification? Senior command explicitly detailed the overstep is lawful. This is no longer open to debate. The congressperson takes counsel on these matters. How many do you suppose would side with a soldier on a classified information matter?

#7 I'm certain your commander would take issue with your characterization that the military exists to kill people and break things. If you voiced something like this during a CA event you'd be reprimanded. My last tour OEF-A began under "find, fix, and finish" ROE. Our patches and kit had skull and daggers markings. Change of command brought change of climate. No more skulls. No more daggers. Consider black roses for symbolism. The new ROE was "find, feel, and understand". You can't make this up. I was combat arms and this was coming from the top. Your sentiment here is out of step despite being sound. I'll tell you a 'rule' written in blood. If you are threatened, engage. If you suspect see a MAM, investigate. If you suspect ordinance, shoot from a distance to prevent trigger. But all of these are violations of ROE. Those rules and regulations weren't written to protect expensive or sensitive hardware. Those were written to protect relations. In many ways they are at the risk to the soldier.

#8 I understand. My points aren't intended to be contentious so much as an illustration of the different set of "BIG PROBLEMS"


I can appreciate ROE/posture changes with command changes. I was in OIF '04 to '05. When I got there it was "kick in doors and take names", when I left it was "please come out and have tea kind sir". When I say that the military exists to kill people and break things I was speaking from a historical perspective. Why do peoples create armies? There was a point in history where people groups became large enough in size that the job of protecting the group became the role of less than everyone. Those in the protecting role did what primarily? Kill people and break things in between long stretches of boredom.

Put another way, what is the primary capability that modern militaries build?


> This is little different from restrictive corporate firewalls, which are commonplace.

Conceptually, the filtering is little different. This policy, however, is very different in the severity of consequence. The superficial story is that the filters have been implemented. No different than Wikileaks, really. The memo and basis for the filters is a very different story.

The memorandum distributed to address the policy mentions sanctions for soldiers found proliferating the Guardian material. Most concerning is that the filters are described as preexisting filters that prevent the mixing of classified information and unclassified systems. In other words, the Army is classifying Guardian articles as TS level content. This is unauthorized for unclassified systems and to be read by soldiers who lack the appropriate clearance. By unauthorized it is meant to mean punishable under UCMJ as a security violation; it's a criminal offense.

The memo also charges leadership with accountability for establishing a vigilant command climate to underscore the secure handling of classified information. Very likely, this means leaders are empowered to implement local measures to ensure unclassified systems operated by soldiers do not house classified information. This is essentially treating a soldier found with an article from Greenwald the same as a soldier who transferred data from a classified system.

The criminal conduct aspect here is, to me, very different from restrictive corporate firewalls.


I'll point out that any device connected to a military Information System is subject to monitor and interception for the expressed purpose of penetration testing, personnel misconduct, network operations and defense, COMSEC, etc.

Do you believe your laptop is a device connected to Google Information Systems when you access GMail?

Soldiers must use their AKO/DKO portal for college coursework, medical appointments, webmail, annual certification and training, and so on. Any system can access AKO/DKO, which includes a personal laptop. Soldiers staying in barracks often have high speed internet access they pay for themselves but they could go to an internet cafe and browse the web.

Is it a civilian channel if a soldier buys a Macbook and reads a Guardian article at Starbucks? If there is a random barracks inspection, which the soldier is subject to, and the Guardian material is found in browsing history and/or cache, the soldier has committed a security violation. S/he will be subject to the same UCMJ action as a soldier that knowingly copied classified information from a classified system and transferred it to their personal computer.


And how then are the soldiers supposed to find out whether their orders are legal or not when the information needed to acquire such knowledge is kept from them by law?


This is my concern, as well. Their command tells them what is and isn't lawful. In this case, command is making explicit what will be considered unlawful. And the unlawful act isn't accessing DoD classified systems inappropriately; the unlawful act is accessing public, unclassified systems, which have been classified at large, in reaction to the leak.

I cannot overstate my concern that this is a classification of the Guardian as a whole to criminalize soldiers's accessing it. It classifies all of the Guardian at a TS level equivalent to the data leaked by Snowden.


You also swear to defend the constitution against all enemies foreign and domestic. You further face UCMJ action for following unlawful orders. When the soldier is not qualified to know the difference between a lawful and unlawful order, they default to obeying the orders of senior commissioned officers. Thus the directive from the senior most command. The soldier has no choice but to obey a lawful order and this is meant to clarify the lawfulness. This is making the access of certain unclassified, public systems unlawful according to UCMJ. We are in a position to reject this notion and speak out against it. The soldiers are not. We have an obligation here. I do not believe our obligation is to remind soldiers of the contract.


The soldiers have zero right to use the Internet at all on work hours.

The government could as easily have said "just focus on .mil and .gov sites when you're using government computers for government work".

The military already frequently bans stuff like YouTube when dipshits keep clogging up the network watching Bieber while other people are trying to do work, or things like Reddit.


> The government could as easily have said "just focus on .mil and .gov sites when you're using government computers for government work".

This is a great point. They could have given guidance on avoiding exposure to the leaked documents. Instead, they criminalized the consumption of publicly available information. Keep in mind that a soldier does not keep 'work hours'. They are not off-duty at any point. They are subject to UCMJ, as well as uniform and appearance regulations, even on the weekends. This includes using a personal computer to access the Guardian on the weekend from a Starbucks.


I think the point, made earlier in this thread, is that the access of that information was already criminalized, from before it was released (due to it's classified nature), and that releasing it does not automatically unclassify it.

In that light, the blocking of the Guardian may be viewed as preventing soldiers from accidentally performing a criminal act.


    This is making the access of certain 
    unclassified, public systems unlawful 
    according to UCMJ.
I think that's indisputable. If the public system has classified material on it, then it is unlawful for someone without the proper clearances to read it.

    We are in a position to reject this notion 
    and speak out against it. The soldiers are 
    not.
Last I checked becoming a soldier was currently a voluntary act.


It is not my intention to quibble with you. I respect that you see this differently than I do. I wanted to be explicit about this because I do disagree with the conclusions you draw but not because you are drawing them.

The problem with making the access of public, unclassified systems punishable by UCMJ seems obvious to me. I do not think you agree with this being a problem. I'm open to your exposition and I hope you are to mine.

If tomorrow is the day that Greenwald will publish Snowden's leaked information then today the Guardian is a website that a solider can access without UCMJ consequence. The common soldier does not possess a security clearance. Among those who do, they do not have access to the material Snowden leaked. That is highly compartmentalized. Therefore, even soldiers with a Top Secret (TS) clearance would not recognize classified information leaked by Snowden as being authentic. The information is on an unclassified system on non-mil, non-gov domain. Greenwald and Snowden claiming it is leaked classified material isn't sufficient for a common soldier to regard the data as such. This requires verification by senior commissioned personnel. Command must inform unwitting soldiers that the information they are reading is classified. Until they do, the soldier cannot be certain. This is effectively classifying any information published by the Guardian as TS. It is unlawful, then, for the soldier to use an unclassified system to access a classified system. If this was only about justifying a block or filter then there'd be little to discuss. But this is about making the soldier's exposure to classified information unlawful, witting or otherwise. Most problematic to me is the fact that command issued this statement to formally classify the information as the soldier is concerned. That is one shade of grey apart from command divulging classified information to personnel that do not possess the clearance.

Command recognizes that they are partly corroborating Snowden's leak if they specifically refer to the content of the documents. They've been careful to cover their ass, though. Instead of explicitly citing the classified information, they classified the source- the entire system. This is the precedent that concerns me. This is command classifying information to empower them to leverage the maximum authorized penalty under UCMJ. This is worse than censorship. This makes reading certain public domain a criminal act.

To your final point I cannot understand your reasoning. Yes, it is a voluntary act. It is a service that people volunteer for that benefits the entire nation. It benefits many other nations. And for this you want to strip them of something? These individuals volunteered to be engaged in the needs of the military. That's to say they aren't guaranteed they will be or do any particular thing. They will be and do what they are told. In some situations that's compromised the individual in ways that would be criminal outside of service. And to that we say, "you volunteered and signed your life away"?

The soldier volunteered to do a job others wouldn't. In cases like these, the soldier hopes civilians will volunteer to do what they cannot. I elect to speak out against this and demand clarification. I charge this is unlawful and dangerous beyond any soldier reading a website might be because the soldier cannot.

What course of action do you propose to a soldier that might be reading this? If what was happening was unlawful in your eyes, what would you suggest is done by the soldier?


> I do disagree with the conclusions you draw

Can you tell me which conclusions I've drawn? I'm just stating fact here. Accessing secret information via public channels is still breaking the law. Is it right? That's a very difficult question to answer since the people whom this affects (people without need-to-know) have entered into that world willingly and presumably know what they've signed up for.

> The common soldier does not possess a > security clearance.

I'm not sure I follow this. Laws against reading privileged information apply to everyone no? Again, I'm not saying that's right or wrong, only that's the condition that we live in.

> This makes reading certain public domain > a criminal act.

No one has been charged with anything. The have Internet filters set up to block that site from certain government machines. I'm not sure that this extends to being prosecuted for reading the Guardian recipes section at home.

> want to strip them of something

They are not stripped of anything. They were never allowed to read classified information that they were not given explicit access to. That the entire Guardian site is blocked is more likely a matter of laziness than evil.

> you volunteered and signed your life away

That's a bit dramatic and I never said that. My only point is that they signed up knowing that they are barred from accessing information not meant for them.

> I charge this is unlawful

My point is that I don't think that it is. It sucks for sure.

> what would you suggest is done by the soldier?

I've never been a soldier, so I don't know what their channels of recourse happen to be.


You certainly can 'consume' classified information without the required clearance. Every reader of the Guardian supports this. Soldiers that have not been read on, soldiers that do not possess a clearance, can be guilty of a security violation yet they've never had access to a classified system.

What this proposes is that every system with classified information on it is to be classified to the level of the information it contains. Because the system was not approved for housing classified information, the system is subject to destruction. Because the DoD does not own the Guardian's systems, they have to assert their authority over the systems they do own: theirs and those of their soldiers.

Do you not see a difference between the soldier that breaches the NDA by disclosing information and the soldier that has been exposed to the information in the public domain?


You are absolutely correct about the compartmentalization and physical separation of classified and unclassified systems.

I disagree that this is about keeping "clean" systems clean. That is the justification for the block. The implied task, which typically carries tremendous latitude, is in this clause:

> Leadership must establish a vigilant command climate that underscores the critical importance of safeguarding classified material against compromise.

Officers will discuss this in an email, maybe during a routine brief, and issue intent (maybe guidance) to the NCOs. That clause about the vigilant command climate being underscored is where the NCOs will be interpreting the implied task(s). Somewhere, for some units, this will be similar to the way alcohol and pornography is handled. There will be an amnesty and then there will be barracks inspections. Platoon and team leaders will treat any device used to access an unclassified system as though it were a thumb drive. Most of the lower enlisted depend heavily upon their Defense Knowledge Online (DKO) portal and webmail. Many use personal computers to access from their barracks. Medical records, address books, professional development, college coursework, all are accessed through the portal. If you have been keeping up on the Snowden leaks on your personal laptop and you are caught with that material on your personal laptop, which you use to access DKO, you will be charged with a security violation. Your clearance will be revoked. You will lose your job and there will be a criminal investigation. If you sync your phone with your laptop, that will be inspected, as well. Your phone might as well be a thumb drive. If you have an email with Snowden material attached to it in your GMail Inbox, and that is pushed to your phone but you fail to report and scrub it, you will be charged.

These are marching orders. Soldiers will feel the squeeze from this.


> if ... you are caught with that material on your personal laptop, which you use to access DKO, you will be charged with a security violation

Yes, as is the same with all other classified information. How else should the government deal with it? De-classify the information? If you have a security clearance you should know that you should never have classified information on a un-classified computer system. There's nothing new about this.


Prior to Wikileaks and an Executive Order addressing the matter of classified information in public domain, the presence of classified information on an unclassified system almost certainly required a deliberate effort to remove the classified information. A soldier would have had to gain access to the classified system and deliberately violate regulation to extract the information. Finding the classified information on an unclassified system would otherwise have exposed gross negligence or criminal intent. This is shifting the focus from the violation that took place to transfer classified information to an unclassified system; it shifts the focus to exposure to classified information on an unclassified system.

Not every soldier is familiar with handling classified information. Their ignorance is bliss. They do not have access to classified systems. Now, though they have no access, they are to be treated as though they mishandled classified information because they visited a public domain website on their personal computer. They had to be told the information was classified because they otherwise could not be certain.

This is new enough. I do understand your position about data at rest. But I believe there is a difference based upon where the classified information was encountered and how it got there. If it is on an unclassified system, and it got there via communication with an unclassified system, I fail to see the soldier's violation. When the soldier's mother expressed outrage over the leak or details of the leak is the soldier supposed to report her and cease contact?

The block is one thing. The bit about leadership and climate is another.


And that´s why the system fails to protect the informations routinely. It makes sense from the rules point of view, but lacks perspective and is not practical.

It´s just trying to grab a pint of water with your hand, no matter how hard you try and how many rules you set, it´s not going to work.


What would happen if, say, a common Linux distribution integrated classified material into its base documentation (not unreasonable; encryption algorithms can be classified, for example) and then pushed that change out as a bugfix-level auto-update? Would tens of thousands of people suddenly be breaking the law?


Surely once information's been published in a national newspaper it should no longer be treated as classified.


I'd like to clarify the bit about his Special Forces 'training'. He did not receive any.

There is a program that he signed for called the 'X-ray' program (18X). It affords the enlistee a pipeline directly to Special Forces Assessment and Selection (SFAS). There is no faster way to go to SFAS than the 18X program.

The 18X program begins with 16 weeks of Infantry training followed by 3 weeks of Airborne school. This is not Special Forces training, however. It isn't even around Special Forces personnel- not even in the same state. Those 19 weeks encapsulate the period of time leading up to his "training accident" that resulted in his separation.

Had he completed Infantry OSUT and Airborne, he would have been sent to a 4 week preparation and conditioning course and then given a slot for SFAS (which is another 3 weeks). At that point, he STILL would have had ZERO Special Forces training. He's only been assessed for toughness and fitness generally speaking. Were he selected, he would begin the Special Forces Qualification Course (SFQC). During the time he enlisted, had he actually entered the SFQC, he would have begun with a preparation course for Small Unit Tactics (3 weeks). The closest to Special Forces training he'd have at the conclusion of that course would be land navigation and patrolling. No guerrilla warfare. No survival school. Nada.

His tactics are not so novel. He's taken "by, with, and through" from indigenous personnel to state agency.


I agree. Ignorance is certainly exacerbating this matter.

I was facing criminal charges for a python script that monitored a mail server that I owned. My security clearance was suspended. My professional reputation was tarnished. The charge was that I "hacked" several computers. With no evidence, with little more than a complaint from two people, all of my previously reputable work (never mind my TS clearance) was discarded and I was regarded as a threat. An escort was required if I was near a computer. I could not use any of the Information Systems. I was given a utility closet with a 55 gallon trash can and some cleaning supplies to call my desk. My chair was missing one of the wheels so it rested at an angle. This lasted for four months.

It was impossible to prepare myself. How would my script be 'understood'? I was trying to learn python. The script monitored headers for internal messages being forwarded to external accounts and blocked them. A message was sent to the offending party with the policy that prohibited this act. Pulling from the headers, the message included the intended recipient in the body to the offender. Yet it was more readily believed that I "hacked" the computers of the sender and recipient to accomplish the effect.

Though this is trivially understood, it is not easily accepted by people who are not aware of the fundamental mechanisms of a mail server. I attempted to explain my script using postal mail as an analogy. I explained the auto response as being similar to vacation messages. The charges escalated from "hacking", which was the compromise of a system I did not own, to interfering with the delivery of sensitive information. I was mortified. In trying to explain what I was doing, I dug a deeper hole. Fortunately for me, definitely not for the 'victims', the information that was being sent was now classified and regarded as sensitive. The fact remained that I owned the mail server and it was not authorized for use transmitting sensitive information, which is the responsibility of the 'victims' to know. The charges were promptly dropped and I spent the next several months clearing up the matter with the rumor mill. My clearance took quite a while to be reinstated. I was no longer regarded as a credible subject matter expert to seek for consultation. I was blacklisted, in a sense. I packed up and moved on when I could.

I wanted to better understand Python and mail servers and it nearly crushed me. Once I was labeled as a "hacker", the most diabolical intentions were projected upon my every behavior. Encrypted emails? Suspect. Modified a router to respond to all probe requests? Sinister. Assembled a transparent bridge using commercially available equipment in your garage? Treasonous. I was concerned that my curiosity would held against me. It was a nightmare. That is as mush as I can recount.


... and this is why I absolutely refuse to work for the government.


This is what the default posture for a domestic raid looks like because the men who trained these troopers were most likely veterans who specialized in urban operations over the last decade of conflict.

The line between military and police is blurred beyond distinction at this point. It is more jurisdictional than much else. As I watched the raid footage it was clear that I was watching a familiar routine. Probably rehearsed several times but not exclusively for this particular raid.

Some argue that conflict is universal and the tactics of SWAT, for example, naturally resemble those of the military. Close quarters battle (CQB) is made up of a dynamic that has few enough variations that a universal approach might make sense. Rather than asking how a Ranger unit should clear a mansion versus how SWAT should do it, the idea seems to have been that there ought not be a difference. This wasn't always the case. To prepare for urban operations in Iraq, many units trained according to police tactics (CQB in particular). There were fatal flaws in the method and it cost lives. Better methods were developed and later became SOPs shared with the police.

There are a handful of contracting outfits that employ recently retired operators from Special Operations to train international elements in tactics. Special Operations operators have experience working in small teams and training other elements. This model is not only effective at lowering costs for Defense, it also resembles the size element a police unit might have at its disposal. Operators with experience working under austere conditions could provide a lot of value to an organization with a comparatively limited budget. The training given to Special Operations is without rival. Being trained by the retired SOF is the next best thing to being trained for SOF.

The NZPD definitely planned the execution around the SOPs. The contingencies their plan prepared for did not seem to be the most likely course of action they expected from Dotcom's two man security element. I felt like they started with a more excessive template and stripped out what they could according to the risk assessment. This is radically different from building the concept of operation from the risk assessment.

For example, consider the M4's used. It was said these were standard issue. These had optics for engaging at a distance between 150 - 300 meters. Each trooper had a 9mm side arm. An MP5 or UMP9 as their primary would make more sense given that it also uses the 9mm. Sure, those are limited in engaging distance targets but what were they expecting? A shootout at the perimeter? Not with a helo infil.

This tactic is called a show of force. It is very consistent with American tactics but not uniquely so. It is exactly what it sounds like- an exhibition. The justification is typically "force protection". A trooper is more valuable than equipment so spare no expense to protect the trooper. That's the line, anyway.

I think the most interesting aspect here is the decision to execute with downgraded armor. The mentality of the operators was that they could make compromises in their defensive load but not their offensive load. But their plan was to breach a huge mansion. They have some idea what's inside but who knows what Dotcom might be doing on the other side of the front door at the moment of breach (or any other door thereafter). These men certainly weren't expecting that he was sitting on the other side with a weapon or they never would have conducted a breach with light armor. The first guy in is guaranteed dead if he isn't wearing a chest plate that can stop 7.62. The chances for the second guy are slim. Their infil was by helo meaning the weight of heavier armor would not matter much. They had to sprint about 100 meters from touchdown to the front door. The light armor is the most damning aspect of the testimony, in my opinion. It is the clearest indication to me that these guys were very confident that they would catch Dotcom sleeping or reading the paper in his underwear. These guys began the mission confident that they could walk right through the front door and scare the piss out of Dotcom. So why not do just that? Why was this level of force the default posture? It only increases the likelihood of unnecessary casualties.


I received the three messages while I was reading the linked article! My messages came from "MobibroIQ". I did not respond.

I logged in to AT&T and launched a chat with Technical Support. I indicated in my description that I wanted to place a purchase block for 3rd party services billed to SMS. The entire exchange took about 10 minutes. I received an email for each line on my account indicating the purchase block had been activated and that a PIN code would be required for charges to apply. AT&T reported that the change could take up to 90 minutes to take effect. As I am typing this, I received a message from this "MobibroIQ" stating, "This msg confirms that u have discontinued and will no longer receive messages or charges for this service..."

Again, I did not reply "STOP."

I hope this solution is as painless and simple for you as it was for me.

EDIT: Follow up message from AT&T "To confirm, purchase blockers have been added to all lines and also checked your line #### & cancelled a subscript.charge for $9.99, will see credit next bill"


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: