This request (case number 1363960-000), filed on December 16, 2016, asked for a review of the FBI’s Cyber National Threat Assessment for the year 2008, as found in the reference citation above. The document, dated June 22, 2009, is an intelligence assessment by the FBI.

The document provides an in-depth analysis of the cyber threats to the United States, focusing on remote system intrusions or unauthorized access against the nation and its critical infrastructure. It covers the period from June 30, 2007, to July 1, 2008, while also incorporating earlier material for context. The assessment addresses various aspects of cyber threats, including tactics, techniques, and procedures used against process control systems, financial institutions, government networks, and the supply chain. It also explores the potential use of tools and technologies such as IPv6 and virtual worlds by malicious actors.

One of the key highlights of the document is the emphasis on the persistent threat posed by botnets. The assessment states, “Botnets continue to pose a threat to US critical infrastructures. These networks of compromised computers can be used to wage denial of service attacks against targeted online entities, conduct phishing and spamming campaigns, and steal passwords and other login credentials”.

The document also sheds light on the evolving nature of cyber threats, noting that attackers continuously develop new methods to exploit vulnerabilities. It mentions that “Attackers typically collect passwords, login credentials, keystrokes, credit card numbers, and personally identifying information from botnet victims”, highlighting the diverse objectives of cyber attackers.

The document remains heavily redacted, citing exemptions such as (b)(1), (b)(3), (b)(6), (b)(7)(C), and (b)(7)(E). These exemptions under the Freedom of Information Act (FOIA) and the Privacy Act, which justify the withholding of information from public disclosure, are defined as the following:

• (b)(1): Information that is classified to protect national security.
• (b)(3): Information exempted from disclosure by other statutes.
• (b)(6): Information that would constitute a clearly unwarranted invasion of personal privacy.
• (b)(7)(C): Information that could reasonably be expected to constitute an unwarranted invasion of personal privacy.
• (b)(7)(E): Information that would disclose techniques and procedures for law enforcement investigations or prosecutions.

As noted in the release letter, the redactions were made by the United States Air Force – Office of Special Investigations (AFOSI), National Security Agency (NSA), Office of the Director of National Intelligence (ODNI), and United States Cyber Command (USCYBERCOM).

The heavy redactions in the document indicate the sensitivity of the information related to national security and law enforcement techniques, even after 15 years since it was originally written.

Document Archive

FBI intelligence Assessment, FBI Cyber National Threat Assessment – 2008, dated 22 June 2009 [30 Pages, 10.3MB]

Loading...

Taking too long?

Reload document

| Open in new tab

Download [10.30 MB]

The post Declassified FBI Cyber Threat Assessment Illuminates 2008 Digital Dangers first appeared on The Black Vault.

The inspection, carried out by the Office of Independent Oversight and Performance Assurance (OA), was comprehensive and performance-oriented, covering six key areas: classified matter protection and control, personnel security, physical security systems, nuclear material control and accountability (MC&A), protective force, and protection program management​​​​.

Notably, the inspection occurred concurrently with separate investigations by the DOE Inspector General, the FBI, UC, and Congress into allegations of missing government property and misuse of laboratory credit cards. However, these investigations did not influence the OA’s inspection scope, focusing instead on the protection of special nuclear material and classified information​​.

A significant revelation during the inspection was related to LANL’s inventory of accountable classified matter, where a hard drive was initially unaccounted for but later resolved. This incident, among others, was thoroughly scrutinized during the inspection, underlining the depth and rigor of the OA’s evaluation process​​.

The document meticulously details the inspection’s findings, conclusions, and assigned ratings to various security aspects of LASO and LANL. It highlights the strengths and weaknesses of the respective programs, with an emphasis on areas requiring immediate and sustained management attention​​.

For instance, while many security program elements at LANL were functioning effectively, there were identified weaknesses, particularly in the MC&A program. These deficiencies included flaws in the physical inventory process and inadequate oversight by the LANL MC&A Group, necessitating immediate corrective actions​​.

The report also underscores the need for a fully staffed Security Management Team to provide adequate direction and oversight, a challenge exacerbated by the reengineering of NNSA and the redistribution of responsibilities from the Albuquerque Operations Office to LASO. This staffing issue poses a significant risk to the efficacy of the federal oversight of safeguards and security programs at LANL​​.

In conclusion, the document acknowledges the steady progress made by LANL in addressing past security deficiencies, while emphasizing the necessity for continued management support and attention to maintain and enhance the security environment. The majority of the protection program elements at LANL were found to be effectively implemented, with some sub-elements demonstrating near-flawless performance. However, the document does not shy away from highlighting areas needing urgent improvement, particularly in the MC&A program, to restore its previous high performance standards​​.

The ratings assigned to the various safeguard and security areas reflect a predominantly effective performance across most domains, with the notable exception of the MC&A program, which was flagged as needing improvement​​.

This declassified document is a testament to the intricate balance of maintaining national security while ensuring transparency and accountability in the management of critical national assets. It provides valuable insights into the complexities of security management at one of the nation’s most sensitive nuclear facilities.

Document Archive

Independent Oversight Inspection of Safeguards and Security of the Los Alamos Site Office and Los Alamos National Laboratory, February 2003 [98 Pages, 22MB]

The post LANL’s Security Inspection: A Declassified 2003 Analysis of Safeguards and Accountability first appeared on The Black Vault.

The National Reconnaissance Office (NRO) began in 1961, but operated in secret for decades before it was officially acknowledged. Before the existence was declassified, in 1974, they evaluated numerous incidents where the agency was talked about within the press. The concern was how the Soviets, or the media, would react.

This document was first released to the National Security Archive (also archived below) and was heavily redacted. In August of 2019, I filed a Mandatory Declassification Review (MDR) request to have it reviewed. To my surprise, all redactions were lifted and it was released in full minus one name at the end of the report.

Document Archive

History of NRO Security Breaches, January 7, 1974 [6 Pages, 1MB]

Loading...

Taking too long?

Reload document

| Open in new tab

Download [973.31 KB]

Archived Versions

Original Release to the National Security Archive

Loading...

Taking too long?

Reload document

| Open in new tab

Download [38.69 KB]

The post History of NRO Security Breaches, January 7, 1974 first appeared on The Black Vault.

The U.S. Postal Service’s security program is designed to reduce the incidence of crime against employees, the mail, and other assets, as well as maintain the integrity of the Postal Service .. The Postal Service faces a variety of security challenges and threats that it must take seriously. Our objective was to determine whether the Capital District had an effective anonymous mail program in place to prevent potentially dangerous mail from entering the. mailstream and a workplace violence program to mitigate violence.

We developed an enhanced security risk model to identify high-risk districts that warrant further review. We analyzed data related to anonymous mail, which
is ___________________________________________________________________________.

We also analyzed data related to workplace violence; suspicious and potentially dangerous mail; and Voice. of the Employee survey results covering fiscal year 2012, Quarter 3, to fiscal year 2013, Quarter 2.

What the OIG Found

The Capital District did not have an effective anonymous mail program in place to prevent potentially dangerous mail from entering the mailstream and a workplace violence program to mitigate violence. For example, the Capital District had an average anonymous mail testing failure rate of ___ percent. In addition, Capital District employees did not always follow policy when handling anonymous and potentially dangerous mail and did not always comply with workplace violence prevention requirements to effectively mitigate violence in the workplace.

The greatest opportunity to limit inappropriate use of the mail is during the earliest point in the Postal Service’s distribution system. Potentially dangerous mail or an act of workplace violence could put employees, mail, assets, and the public at risk and negatively impact the Postal Service’s brand. Enforcement of good security practices is essential to an efficient and economical operation.

What the OIG Recommended

We recommended management clarify employee roles and responsibilities, require personnel to take additional training, implement anonymous mail program best practices, complete the workplace violence self-audit tool, and establish controls to ensure personnel comply with anonymous mail and workplace violence requirements.

The Report

 Report Number HR-MA-14-003 – Security Risks in the Capital District Management Advisory Report – dated January 27, 2014 [39 Pages, 5.9MB]

https://documents.theblackvault.com/documents/ig/HR-MA-14-003FinalDetermination.pdf

The post USPS Investigation: Security Risks in the Capital District Management Advisory Report, January 27, 2014 first appeared on The Black Vault.

This Instruction:

1.1 . Reissues reference (a) to implement policy, assign responsibilities, and prescribe guidance on the classification methodology for Information Operations (10) programs and capabilities within the Department of Defense.

1.2. Establishes guidance for proper protection of 10 activities.

1.3. Identifies and provides classification guidance on categories of IO activities. While this Instruction identifies the classification or classification ·range for specific items of classified information, it is not intended to be used as an itemized guide for applying Special Access Program (SAP) prota;tive measures. If required, SAP protective measures shall be in addition to the protections that are cited in this Instruction. 1.4. Addresses the relationship between the protection level for 10 activities and the security classification for specific elements of information within these activities. It clarifies information and requirements from a number of sources to identify the appropriate protection architecture for IO activities.

1.5. Constitutes authority and, in the absence of an approved program classification guide that provides specific classification instructions, shall be cited as the basis for derivative classification about, or declassification of, DoD information and material involved in 10.

DoD Instruction 0-3600.02

As of October 2016, this version is the latest.

 DoD Instruction 0-3600.02 “Information Operations (IO) Security Classification Guidance, November 28, 2005 [22 Pages, 4.9MB]

https://documents.theblackvault.com/documents/dod/14-F-1161.pdf

The post DoD Instruction 0-3600.02 “Information Operations (IO) Security Classification Guidance,” November 28, 2005 first appeared on The Black Vault.

The Federal Bureau of Investigation (FBI) Foreign Government Information Classification Guide (FGICG) provides guidance concerning the classification and level of protection afforded to foreign government information. The FGICG is not intended to provide specific guidance concerning the handling, safeguarding, transport, declassification and downgrading, destruction, or administration of classified material, whether in paper or electronic form. Specific guidance concerning these topics is available in Executive Order (EO) 13526, “Classified National Security Information;” Department of Justice (DOJ) Security Program Operating Manual (SPOM); FBI Security Policy Manual (SPM); FBI Automatic Declassification Guide; FBI Foreign Dissemination Manual (FDM); Federal Register, Part V, National Archives and Records Administration (NARA), Information Security Oversight Office (ISOO) Final Rule (32 CFR Parts 2001 and 2003); and other documents referenced herein.

The duration of classification, classification markings, and other requirements of EO 13526, are to be applied to information classified pursuant to this guide, in accordance with the SPM and other approved FBI policies and procedures.

Declassified Documents

 Federal Bureau of Investigation (FBI) Foreign Government Information Classification Guide, June 20, 2012 [66 Pages, 2.9MB]

https://documents.theblackvault.com/documents/fbifiles/FBI-G1Guide.pdf

The post Federal Bureau of Investigation (FBI) Foreign Government Information Classification Guide first appeared on The Black Vault.

According to their website:

“VUPEN is the leading provider of defensive and offensive cyber security intelligence and advanced vulnerability research. While other companies in the vulnerability intelligence industry mainly act as brokers who buy vulnerabilities from third-party researchers and then sell them to their customers, all VUPEN’s vulnerability intelligence results exclusively from our internal and in-house research efforts conducted by our team of world-class researchers.”

With this news, I filed a FOIA request for ALL current contracts between VUPEN and the NSA.  Below are the responsive documents — many declassified for the first time on this request.

 NSA Contracts with VUPEN, released October 2013 [31 Pages, 6.99MB]

https://documents.theblackvault.com/documents/nsa/nsavupen.pdf

The post VUPEN / NSA Contracts first appeared on The Black Vault.