Spy case demos insider threat

The career FBI agent charged with spying last week had significant IT experience and access, underscoring the growing threat to corporate data by insiders.

The agent, Robert Phillip Hanssen, was charged with spying for Russia since 1985. He allegedly gave Russian intelligence agents highly classified documents and details about U.S. intelligence sources and electronic surveillance, in exchange for an estimated $1.4 million in cash and diamonds.

According to a 100-page affidavit filed in the U.S. District Court in Alexandria, Va., Hanssen used his computer access to the FBI's Electronic Case File system, which contains classified information about ongoing FBI investigations, to check whether the FBI had been alerted to his activities.

The lesson for corporate America "is that companies tend to gain a false sense of security from strong perimeter security," like firewalls and intrusion-detection systems, said Eric Friedberg, a former computer and telecommunications crime coordinator at the U.S. Attorney's Office in New York. "What goes on behind the firewall can be even more damaging because of the degree of access insiders have."

Friedberg is now a computer crime consultant at Stroz Associates LLC in New York. During the past six months, the firm has worked with half a dozen companies that have been victimized by insiders, said Friedberg. Those cases involved everything from deleted files to cases where individuals covertly set up competing businesses on their employers' servers, he said.

Because Hanssen was an authorized user, his queries didn't raise any suspicion. However, after Hanssen was arrested while allegedly dropping off classified paper documents for his Russian handlers, the FBI was able to correlate his log activity in the database with his espionage activities.

"In short, the trusted insider betrayed his trust without detection," FBI Director Louis Freeh said during a press conference.

Freeh has since ordered that a special panel be formed to review all FBI processes and systems and to study the issue of insider abuse.

According to a survey of 359 companies by the FBI and the Computer Security Institute in San Francisco, companies lost more than $50 million last year as a result of unauthorized insider access and abuse of IT systems. Some 38% of firms in the survey reported between one and five incidents of insider abuse. Another 37% said they didn't know how many breaches had taken place.

Hanssen was assigned to the New York Field Office's intelligence division in 1979 to help establish the FBI's automated counterintelligence database in that office. Investigators characterized Hanssen as having a "high degree of computer technology expertise."

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine