US Government Security Data Up For Grabs After Another NSA Leak

It’s known as Red Disk, a cloud-based intelligence sharing system created by the National Security Agency (NSA). Red Disk is part of an NSA division, led by U.S. Army Intelligence and Security Command. The idea for Red Disk was to collect real-time information for the Pentagon during the 2013 Afghanistan war. The real-time data could then be disseminated to U.S. computer systems and American troops on the battlefield. Just some of the data included satellite imagery, drone footage, and audio databases. In 2014, the NSA scrapped Red Disk (and its $93 million+ Pentagon price tag) for what they called “a major hindrance to operations.”

Intelligence collected by Red Disk was to be centrally stored. From there, security analysts using Pentagon-based security clearance would obtain and disseminate up-to-the-second valuable information depending on their security clearance level to the parties that needed it. Red Disk would not just store data, but it collected, correlated, and indexed information using different filters. The data was immediately disseminated to the appropriate command and ground troops fighting in real-time. It’s easy to see the real advantages of Red Disk, had the security surrounding it been adequate. If it helps to be reminded of another huge NSA hack, think WikiLeaks.

This is cybersecurity news because the contents of Red Disk were online for anyone who has online access, anywhere in the world. It was left on a public storage server provided by Amazon Web Services (AWS). No password necessary and ready for download. It’s since been secured, but the identity of the storage service owner has never been determined, which is intriguing itself considering the information stored.

It’s not just happening to the NSA either. Other government departments, Verizon, Viacom, and others have been left hanging in the wind by using unsecured web services, by AWS, but also other service providers. Classified security information, like information regarding targeting terrorists and security keys giving access to data on servers operated by U.S. Intelligence agencies are all part of Red Disk information. One wonders, just how does this country create such incredible cyber-info innovation and not have the security to back it up? This story is not likely over. Not only because of the information leaked, but also what may happen as a result of its disclosure.

It’s a lesson for all organizations when working with third parties and cloud servers. Do the research and make sure that wherever you put your data, it’s secured from prying eyes. While your data may not result in a terrorist attack, it may result in espionage, data breach of customer information, or something else you’d rather not have to remedy.