Classified US military info available over P-to-P

Government and private files made available over P2P file sharing

Millions of documents, both government and private, containing sensitive and sometimes classified information are floating about freely on file sharing networks after being inadvertently exposed by individuals downloading P2P software on systems that held the data, members of a U.S. House committee were told Tuesday.

Among the documents exposed: The Pentagon's entire secret backbone network infrastructure diagram, complete with IP addresses and password change scripts; contractor data on radio frequency manipulation to beat Improvised Explosive Devices (IED) in Iraq; physical terrorism threat assessments for three major U.S cities; information on five separate Department of Defense information security system audits.

Information about the breach came during a hearing on inadvertent file sharing over peer-to-peer (P2P) networks held by the House Committee on Oversight and Government Reform chaired by Rep. Henry Waxman, (D-Calif.) One of those testifying was retired General Wesley Clark, who is currently a board member of Tiversa, a company that sells P2P network monitoring services to government agencies and private sector companies.

Clark described how "in a matter of hours" he was able to lay hands on over 200 documents containing classified and secret government data from P2P networks using Tiversa's search engine. He came across the documents while preparing for the hearing.

Some of the data appears to have come from the system of a contract worker at the Pentagon who installed P2P software on her computer, Clark said. The data included everything from Iraq status reports to a list of soldiers with their Social Security numbers. "They are the complete documents. They are not faxed copies. They are not smudged. They are as fresh as if they were printed off the computer" of the organization they came from.

"There's all kind of data leaking out inadvertently," he told the committee, noting that the documents he cited were "simply what we found when we put the straw in the water. The American people would be outraged if they are aware of what is being inadvertently being disclosed on P2P networks."

It's not just government data that is leaking out; So is a lot of sensitive corporate information, said Robert Boback, the CEO at Tiversa who also testified at the hearing. In written testimony, Boback listed several examples of corporate information Tiversa was able to pull from P2P networks. It found, for instance, the board minutes of one of the world's largest financial services organization, the entire foreign exchange trading backbone of a financial company and a comprehensive launch plan -- complete with growth targets -- of yet another financial company that was diversifying into a new region. Other corporate documents retrieved from P2P networks included press releases not yet issued, patent information, business contracts and non-disclosure agreements.

In addition, the ready availability of federal and state ID cards, passports, Social Security numbers, credit card information and bank account details make P2P networks a great source of information for identity thieves, he said.

Popular P2P clients such as Kazaa, Lime Wire, BearShare, Morpheus and FastTrack are designed to let users quickly download and share music and video files. Normally, such P2P clients allow users to download files to and share items from a particular folder. But if proper care is not taken to control the access that these clients have on a system, it is easy to expose far more data than intended.

Eric Johnson, a professor of operations management at the Center for Digital Strategies at Dartmouth College's Tuck School of Business, testified that inadvertent data disclosure on P2P networks is a "whole lot worse" than many assume.

Speaking with Computerworld after the hearing, Johnson said that accidental information disclosure on P2P networks has become a "substantial issue for government [agencies] and for banks and for large corporate enterprises. Many companies believe that they have implemented adequate internal controls to block access to P2P networksl, he said. The problem with these types of disclosures is that every employee, contractor, customer or supplier is a potential weak link.

"I spend a lot of time with CISOs and CIOs who think they have locked down their networks and made it difficult for people to join P2P networks," Johnson said. But those controls fail when employees take work home and then connect their systems to a P2P network. "CISOs can do a great job hardening their own networks but controlling what thousands and thousands of individuals do is impossible," he said

One company compromised in this manner is Pfizer Inc. In June, the company disclosed that personal data on about 17,000 employees had been inadvertently exposed on a P2P network after the spouse of an employee used a company computer to access a file sharing network.

Another example is the U.S. Department of Transportation. Daniel Mintz, the department's CIO, offered written testimony about how 93 DOT-related documents were inadvertently exposed on a P2P network. The exposure resulted when the teenage daughter of a DOT worker who was authorized to work at home installed LimeWire's P2P client on the computer containing the DOT data. The accidental data exposure was only discovered after a Fox News reporter informed the employee that he had been able to access several DOT-related documents from her computer, Mintz said.

DOT's inspector general "found that 30 of the approximately 93 DOT-related documents were publicly accessible at the time via LimeWire or other P2P software by virtue of residing in a 'shared folder,'" Mintz said. In addition, about 36 out of approximately 260 National Archives-related documents that were also on the employee's computer were in a shared folder and thus similarly exposed.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Show Comments



Victorinox Werks Professional Executive 17 Laptop Case

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?