NSA outsourcing to Booz Allen and other contractors flagged as security risk, with former intelligence heads hired by the firm

218 | HOW AMERICA LOST ITS SECRETS ticated cyber services could have also participated in the hacking. In any case, the records of over nineteen million employees, including intelligence workers, became available to a hostile intelligence ser- vice. This breach would allow hostile services to obtain a great deal of information about independent contractors working at the NSA. They could then use this data to follow the movements of any of these intelligence workers they deemed of interest. Despite all the potential flaws in it, the outsourcing system contin- ued in place. It even featured a revolving door through which Booz Allen hired retiring executives from the intelligence services, such as the former NSA director Michael McConnell; James Woolsey, a former director of the CIA; and the retired general James Clapper, who later served as director of national intelligence. The cozy relationship between the private firms and the NSA notwithstanding, the NSA leadership operated as if it were unaware that outsourcing could create a security problem. As far back as 2005 General Hayden, then the departing head of the NSA, had been warned of one such vulnerability in a memorandum written © by a counterintelligence officer at the NSA. Like the earlier 1996 © report by the threat officer, this memorandum noted the NSA had ceded responsibility for managing its secret systems to outsiders and warned that the NSA’s reliance on them to manage its computers had opened a back door into the NSA. In addition, it warned that once an outside contractor managed to slip in through this back door, he could easily jump from one outsourcer to another. This was what Snowden did when he moved from Dell to Booz Allen Hamilton in 2013. Despite its security flaws, outsourcing seemed to provide a num- ber of advantages to the NSA. For one thing, it provided a means for circumventing the budget restrictions imposed by Congress on hir- ing new employees. In addition, because private companies had less rigid hiring standards, it greatly expanded the pool of young sys- tem administrators by tapping into computer cultures that would be antagonistic to working directly for the government. Finally, it drew less on NSA resources. Because these information technologists were only temporary employees, they were not entitled to military | | Epst_9780451494566_2p_all_r.indd 218 ® 9/30/16 8:13AM | | HOUSE_OVERSIGHT_019706