Contractors and government employees are sharing hundreds of secret documents on peer-to-peer networks

By Grant Gross, IDG News Service
July 27, 2007

Contractors and U.S. government employees are sharing hundreds of secret documents on peer-to-peer networks, in many cases overriding the default security settings on their P-to-P software to do so, according to a company that monitors the networks.

Robert Boback, CEO of P-to-P monitoring service vendor Tiversa, and retired U.S. Army General Wesley Clark, a Tiversa board member, said the company found more than 200 sensitive U.S. government documents during a recent scan of three popular P-to-P networks. The two testified earlier this week before the U.S. House of Representatives Oversight and Government Reform Committee.

Among the files shared: Physical threat assessments for multiple cities, including Philadelphia and Miami; a physical security attack assessment for a U.S. Air Force base; a detailed report from a government contractor on how to connect two secure Department of Defense (DOD) networks; a document titled, "NSA (National Security Agency) Security Handbook."

Many lawmakers directed their criticism toward the Lime Group, distributor of the popular P-to-P software LimeWire, during a contentious hearing Tuesday. But Boback, in a later interview, said his testimony wasn't intended to cast blame on LimeWire.

In many cases, P-to-P users override the default security settings in the software. In LimeWire, the default setting allows users to share files only from a "shared" folder, but many users apparently override the default settings, ignore warnings from the software, and share their entire My Documents folder or other folders, Lime Group CEO Mark Gorton testified.

In other cases, government employees or contractors apparently ignore policies prohibiting the use of P-to-P software on computers containing sensitive government information, witnesses testified.

P-to-P users can also download files with hidden executables that can index the entire hard drive, Boback said, and that can create victims of even expert computer users. But the fault doesn't lie with LimeWire or other P-to-P vendors, he added.

"It's the malicious user writing code that will expose the entire hard drive," he said. "Just because that user is a LimeWire user, it makes it look as though LimeWire indexed their system, when actually it was an executable within a download."

The problem isn't with the P-to-P network itself, he added. "It's just another access for malicious users to index one's information," he said.

In preparation for the congressional hearing, Tiversa scanned the three most popular P-to-P networks, including the Gnutella network LimeWire uses, for two days. Tiversa staff entered common military search terms and found more than 200 secret U.S. government documents, Boback said.

The problem with official government documents on P-to-P networks in general is likely to be much greater; since Tiversa confined itself to military search terms, he said. The company reported its findings to U.S. government officials, some of whom took action to remove the documents, Boback said.

In another scan, on July 17, Tiversa found a defense contractor employee sharing 1,900 files, including 534 sensitive files, from what was apparently a home computer. The contractor, an IT expert, supported 34 U.S. government agencies including the DOD and intelligence agencies, Tiversa said.

Among the files shared from the contractor's computer: The infrastructure diagram for the entire Pentagon secret backbone network; password change scripts for secret Pentagon network servers; Secure Sockets Layer instructions and certificates allowing access to the contractor's IT systems; a contract issued by the U.S. Army Contracting Agency authorizing $1.5 million in fees from the contractor.