Audit on NSA Vulnerabilities Should Be Public, Times Says

MANHATTAN (CN) – Spurred to action by a House intelligence report, The New York Times has sued to obtain a study on security vulnerabilities that may have allowed Edward Snowden to breach the National Security Agency’s system.

Joined in the Feb. 17 federal complaint by investigative reporter Charlie Savage, the Times notes that the Office of the Inspector General for the Department of Defense began its assessment last year at the behest of members of Congress.

“In particular, the House asked DOD-OIG to determine whether the NSA had addressed certain vulnerabilities exposed by the actions of former NSA contractor Edward Snowden,” the 4-page complaint states.

Though the Defense Department’s ensuing report is not public, the House Permanent Select Committee on Intelligence made reference to the findings in its September 2016 review of Snowden’s breach.

The Times and Savage say the gist of the IG report is “that the NSA had failed to fully implement certain security measures meant to make the agency less vulnerable to security breaches.”

A month has passed since the Times and Savage asked the Defense Department to produce its Aug. 29 report under the Freedom of Information Act.

Since FOIA requires a response within 20 days, they want a federal judge in Manhattan to intervene.

The Defense Department’s report is titled “The National Security Agency Should Take Additional Steps in Its Privileged Access-Related Secure the Net Initiatives.”

“Secure the Net Initiatives” is a reference to the NSA’s list of network-security improvements that would have stopped Snowden.

The NSA’s improvements included two-person control for transfer of data by removable media, reducing the number of privileged users and authorized data transfer agents, and moving toward a continuous evaluation model for background investigations.

Members of the House intelligence committee found that many of the “Secure the Net initiatives” were never completed and remain outstanding. The House’s report is declassified but heavily redacted.

The Times and Savage are represented by in-house counsel David McCraw.

Savage has compiled a list of his multiple open FOIA cases on his official website.

The Department of Defense has not returned a request for comment.