What happened?
Jack Teixeira, an airman first class in the Massachusetts Air National Guard, worked as an IT support specialist at Otis base and had access to "top secret" documents. According to Reuters, from January 2022 he accessed classified documents beyond the scope of his job and was warned twice by superiors in 2022 about how he handled classified information.
He posted hundreds of classified military documents, including content related to the conflict in Ukraine, to private servers on Discord run by a group of gaming friends. Teixeira was arrested in April 2023, pleaded guilty in March 2024 to six counts of retaining and transmitting classified national defense information, and was sentenced to 15 years in prison by Judge Indira Talwani on 12/11/2024. As reported, she said it was "truly unfortunate" that others had not done more to stop it.
Lessons for enterprises
- High privilege should not come with the right to see everything. IT staff often have broad technical rights, but rights over document content need to be separated.
- Abnormal signs must be acted on. The two warnings in 2022 did not lead to any change in access rights.
- A document posted online is hard to take back. Blocking at the start is far more effective than handling it after it has spread.
A data-centric approach
Enterprises can separate system-administration rights from the right to read document content, so administrators cannot see confidential documents by default. Protected files can be blocked from content copying, screen capture, printing and external sharing in supported environments, while every open is logged. Dynamic watermarks help trace the source when a photo is circulated. See also the product.
Three questions for a self-check
- Can your system administrators read the departments' confidential documents by default?
- Can confidential documents be screen-captured or have their content copied to other applications?
- When there is a warning about how a staff member handles information, what is the process for adjusting their rights?
