In September 2019, Jonathan Teixeira joined the 102nd Intelligence Wing of the Massachusetts Air National Guard as a Cyber Transport Systems journeyman. He was stationed at Otis Air National Guard Base in Cape Cod. In July 2022, he was promoted to airman first class and held a Top Secret security clearance. Despite his low rank, he had access to classified information, given Teixeira’s responsibility for maintaining Top Secret computer networks.
In early April 2023, Teixeira was alleged to have repeatedly shared classified information in a chat group called "Thug Shaker Central" on Discord. Reports suggest that he was the chatroom administrator and that there were between two dozen and fifty members. One member allegedly posted dozens of pictures of classified documents on another Discord server on February 28, 2023. After the documents appeared on Russian-language Telegram channels, The New York Times reported the leak. On April 21, The New York Times reported that an account with similar characteristics as Teixeira's online profile had shared summaries of classified information and likely shared photographs of documents with a Discord chat group of about 600 members from about February 2022 until about March 2023.
On April 13, 2023, the FBI arrested Teixeira at his mother's residence in Dighton. The next day, he was charged with two offenses: violating the Espionage Act of 1917 by retaining and transmitting national defense information without authorization and unauthorized removal and retention of classified information. The first charge carries a maximum sentence of ten years, and the second charge carries a maximum sentence of five years. Teixeira is represented by counsel from the federal public defender's office, and his detention hearing is scheduled tomorrow (April 27). He has not entered a plea yet.
Still want to know how this guy had that level of access. Doesn’t make sense to me.
IT people, broadly speaking, are given horrendously lax access to data, because the nature of their jobs is making sure access and delegation of that data remains proper for the rest of the organization. Can't really delegate access to data if you aren't able to...well, also give yourself access to that data. Back in the day IT admins used to work in pairs that had to authorize each other's actions, precisely because it's obviously a security concern that a lone IT admin has access to basically everything, or can give themselves access to most things they want.
To be clear, you're never getting away with a stunt like that. Someone is gonna hear of a data leak and see the very short list of who's allowed to look at that data, and who has been recently added and removed from that access, and they're going to find you pretty quickly. But, if an IT guy with admin rights wants to do it, there's really nothing other than getting fired or arrested that's stopping them from just doing it.
Everyone in IT knows just how bad security is, and everyone outside of IT is either blissfully unaware, or has an inkling and is desperately ignoring it. It's the same problem every other kind of preventative action plan has, whether it's IT security or climate change: preventing a disaster is expensive, nebulous, and difficult to explain to people outside it's own expertise, and if it does work, nothing ever happens, and nobody can be sure it actually did anything in the first place.
Adage of the IT department: If everything is working, it's "why do we pay you?". If anything is broken, it's also "why do we pay you?".
Which is, of course why any serious intelligence agency bans mobile phones and has normal reports typed up on offline machines running DOS 4.0 and secret reports typed on manual typewriters in a faraday cage while a grim field agent stands at the door.
It's wild about all the shit I had access to. At the various places I've worked, I had access to disciplinary records, payroll, addresses of people's personal residence. At my very first job, I somehow got the email password of an executive. I honestly forgot how I got the password, probably from the executive telling me the password somehow and not changing it after because that place exempted executives from having to change their passwords after 3 months for some really stupid reason. That or she wrote down the password on a sticky note like all boomers do, which is marginally less terrible for her case because she's an executive with her own office that she keeps locked when she's not there.
Honestly, part of my radicalization process was reading through her emails and seeing how executive-level people are all complete entitled, petty, self-absorbed shitheads on top of having absolutely terrible spelling. And so many boomer ellipses.
Knowing the military he was probably the only guy there who knew how to save documents as a PDF
The military really doesn’t vet people as well as most think
Plus if you're 21, born in the U.S., have no criminal record, and can pass a drug test, getting whatever level of security clearance is basically just paperwork. Not even much if you haven't moved around a ton.
If you're behind on student loan payments, though, fuck you -- straight to Secret clearance, and you also can't get PRP-certified to work around nukes.
I think lots of orgs have pretty bad security. It takes work to make systems more secure without massively slowing down people's work.