P-to-P users expose US government secrets

Contractors and U.S. government employees are sharing hundreds of secret documents on peer-to-peer networks, in many cases overriding the default security settings on their P-to-P software to do so, according to a company that monitors the networks.

Robert Boback, CEO of P-to-P monitoring service vendor Tiversa Inc., and retired U.S. Army General Wesley Clark, a Tiversa board member, said the company found more than 200 sensitive U.S. government documents during a recent scan of three popular P-to-P networks. The two testified earlier this week before the U.S. House of Representatives Oversight and Government Reform Committee.

Among the files shared: Physical threat assessments for multiple cities, including Philadelphia and Miami; a physical security attack assessment for a U.S. Air Force base; a detailed report from a government contractor on how to connect two secure Department of Defense (DOD) networks; a document titled, "NSA (National Security Agency) Security Handbook."

Many lawmakers directed their criticism toward the Lime Group LLC, distributor of the popular P-to-P software Lime Wire, during a contentious hearing Tuesday. But Boback, in a later interview, said his testimony wasn't intended to cast blame on Lime Wire.

In many cases, P-to-P users override the default security settings in the software. In Lime Wire, the default setting allows users to share files only from a "shared" folder, but many users apparently override the default settings, ignore warnings from the software, and share their entire "my documents" folder or other folders, Lime Group CEO Mark Gorton testified.

In other cases, government employees or contractors apparently ignore policies prohibiting the use of P-to-P software on computers containing sensitive government information, witnesses testified.

P-to-P users can also download files with hidden executables that can index the entire hard drive, Boback said, and that can create victims of even expert computer users. But the fault doesn't lie with Lime Wire or other P-to-P vendors, he added.

"It's the malicious user writing code that will expose the entire hard drive," he said. "Just because that user is a Lime Wire user, it makes it look as though Lime Wire indexed their system, when actually it was an executable within a download."

The problem isn't with the P-to-P network itself, he added. "It's just another access for malicious users to index one's information," he said.

In preparation for the congressional hearing, Tiversa scanned the three most popular P-to-P networks, including the Gnutella network Lime Wire uses, for two days. Tiversa staff entered common military search terms and found more than 200 secret U.S. government documents, Boback said.

The problem with official government documents on P-to-P networks in general is likely to be much greater; since Tiversa confined itself to military search terms, he said. The company reported its findings to U.S. government officials, some of whom took action to remove the documents, Boback said.

The IDG News Service is a Network World affiliate.