this post was submitted on 12 Mar 2024
1 points (100.0% liked)
United States | News & Politics
7193 readers
983 users here now
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
You don't need clearance to know a document exists, and you don't even need to know the contents or even the subject matter of the document. Just give the document an RFID sticker or similar and you can then track it pretty much anywhere on government property. So an audit would just be scanning tags and comparing with a database that says where those tags should be.
That's obviously simplistic, but it's a proof of concept that the people at places like the NSA or FBI could refine. It should be fairly easy to tell if a document is where it ought to be.
With long range RFID readers existing that is bad opsec. You don't need to know the contents of a document to exploit it's dissemination, in certain cases.
I'm thinking something like this:
Step 2 could use a temporary RFID tag as well, which gets replaced at each checkout. That way all an attacker would know is that an RFID tag is being used, they wouldn't necessarily know it's a classified document.
Obviously the approach would need to be refined (I don't deal with classified documents), but the general approach should work, especially if RFID is used for a bunch of less sensitive documents as well so RFID tags become commonplace.
What's nuts to me is that it took so long for authorities to track those documents down, and they didn't even get them all. They should have all been tracked down between the time Trump lost reelection and the time he left office, and perhaps confined to the White House.
I’m thinking there wouldn’t be enough secure rooms to house all the documents, without making it difficult to access them. I
Basically collecting information on the movement of documents is a security risk in itself.
Papers in a flaming trash can are secured. Not much else.
Sure, but it's not very helpful if most of those documents aren't very interesting. I'm suggesting we tag every official document, whether interesting or not. An attacker would need to know which tags are interesting to get any value from it.
I deal with consumer data analytics, and the scheme that you are positing does expose the frequency and density of specific actors and their access to classified information. This is really valuable, you can tell when someone gets a promotion and maybe has access to more info then they are used to or some other exploitable paradigm.
If it's just a printed barcode sure, it could be tracked like this without exposing information. Trouble is that classified documents are living documents, and the information only becomes classified when it's collected by some operative or officer, who may or may not register the documents with this central tracking authority.
The next issue is the capability of the central tracking authority to review, access, curate all of the reports that it has received, and their confidence that their internal staff do not breach the access rules on these documents hello Snowden.