GCHQ intern took top secret spy tool home, now faces prison A student at Britain's top eavesdropping government agency has pleaded guilty to taking sensitive information home on the first day of his trial. Hasaan Arshad, 25, speaking at the Old Bailey in London, admitted that on August 24, 2022, he took his phone into a highly secure area of GCHQ, the UK's intelligence and security …
How was this possible? Places I've worked that have low-level classified docs on the network have disabled USB ports and off-network file transfer with higher classifications only being accessible behind locked doors on specific machines on an air-gapped network. Unless GCHQ leaves them open to fish for idiots it's incomprehensible that someone could just download stuff to a phone and walk off site.
Anon, because:
I was once given an "access all areas" pass at a very secure site and was told to "wander about" until I found someone to direct me to the meeting I was due to present at.
I went into a building and into an empty office with bar-locked filing cabinets. There were signs on the walls related to stuff I won't comment on and documents left on desks showing security levels well above mine (none).
I eventually bumped into a very helpful guy who directed me to a meeting room a couple of buildings away with doors about 50cm thick (it was also a high-grade shelter).
I suspect someone assumed I worked for the same organisation as a person I was co-presenting with, who did have the relevant security clearance to access the whole site.
Luckily, I am not "one of the bad guys".
"And yet almost everyone accused of hacking by the government has convenient child porn on their PC."
As the archivist of our family photos, which still need lots of scanning done, I have "child porn" on my computer. Me and my sister running around on a hot summer day without our turtleneck jumpers and ankle length gowns on. There's also some bathtub photos that parents are keen to take and use as blackmail when we started dating. If you are in your early teens, never, never, never leave a date alone with your parents.
With teens having phones, there's been plenty of incidents of girls (usually) sending a peep shot to their boyfriends (usually). Snapchat was supposed to be very ephemeral, but a quick screen capture solved that limitation. Boy arrested for child porn since, of course, he just had to share.
The implication from the article is that he was a member of the project team directly involved with development of the software. So, in those last couple of days before leaving, would still have access to it. I assume he got caught out by monitoring software that looks for people downloading suspicious amounts of sensitive code. Even if you do have permission to access it, copying it out of a secure environment would fire an alert.
Putting the most generous spin on it (something which doesn't come easily to me, because I am a curmudgeonly misanthrope) he did this at the very end of his internship; perhaps his thought process was something like "I will download the code I worked with to remind me of my job here and so I can continue to study it, and I will take a copy of the employee details of the colleagues and managers I work with so that I can get in touch with them to give me a job after I graduate?"
Even if that were the case, mind you, he's still - at best - a total idiot.
Many years ago I was taking a small group round a business I used to work at. They were guests of the Chairman & Chief Exec so had friends in very high places. I was told to show them everything including the Server rooms etc. Well as we were approaching the secure door to the server room I asked everyone to show me that their phone was off not just on airplane mode before entry. Most people were happy to comply except one pompous git who said he couldn’t do that as he was so important he couldn’t risk missing call etc.
I said okay fine you can wait out here whilst the rest of the group go in. Boy was I unpopular with him, he tells me he’s mates with the CEO or the Chairman (can’t remember which) and I should be more respectful etc. I pointed to a sign that said something like no mobiles no exceptions and reiterated he wasn’t going in with his switched on. Well he’s unhappy with this but eventually after repeating my ultimatum he agreed to turn the phone off.
Tour (including the roor terrace with very good views) over we head to the boardroom where the CEO and Chairman are waiting. Mr Important relays his disgust at having to turn his phone off and says it was all my fault. One of the two most senior bosses looks at him and says “Oh come on man up and grow a pair, if he says turn it off then do so, I have to too.”
I made my excuses and left at this point. This wasn’t a top secrets containing secure installation in any way like GCHQ. I would have hoped that they had more stringent and stricter rules and regulations.
My last place was hardly Spook Central but was similarly locked down. They would even detect if a local drive had been swapped out in case you saved stuff to it and disassembled the machine to take it home with you. The only way I could think of to exfiltrate stuff (which I wasn't particularly interested in doing as nearly all of what I worked with was written by me...) was to OCR the screen one page at a time....
Anyway, not much of a vetting job by whoever gave him the placement.
"Anyway, not much of a vetting job by whoever gave him the placement."
They usually spend several days going over all of the security requirements, prohibitions, sexual harassment lectures, how to report on your family, the usual stuff and then watch as you read and sign the Official Secrets Act agreement. You'd think that for somebody to do this on the first day they'd have to have a 50 IQ and noticeably drool.
He probably stole a shell script or some little app he was working on, but never stopped twice to think about it.
Who hasn't copied work code to their private laptops raise the first stone, but not many of us work in a security paranoid place. These days I would be much more careful to keep things in my head, not in my hard drive.
The official secrets act applies even if you haven't signed the piece of paper or online document.
The document we sign explicitly states the responsibilities for those likely to come into routine contact with classified information so there can be no doubt what the rules are.
Yes, oddly enough I ran into a situation where some information appeared on my personal email due to a mistake, with not only highly sensitive medical data on it but personal information including unlisted phone numbers of several high profile celebrities over here. Obviously did the right thing and informed the appropriate authorities, though they didn't ask for me to wipe the drive or anything like that.
With the 'Official Secrets Act' I believe that if someone discovers through research classified data that had been accidentally or deliberately posted online, they are legally required to report it.
It has happened that an inventor has gone to do a patent search only to find that their 'world changing idea' in fact belongs to HM Government and this can cause significant problems.
Why was the defendant admitted to a highly secure area without being impressed by the need to surrender his phone?
Given that the secure area is open to people on short-term contracts, why are such people entering it not checked for items they carry? More to the point, why is anybody other than trusted individuals of some standing admitted if the area contains a "top secret" tool which they estimated was worth millions of pounds? Else, is "top secret" a gross exaggeration? Does "worth millions of pounds" refer to black-market value rather than development cost? Would anyone care to speculate about the nature of this extremely desirable software?
What prompted suspicion about the defendant's activities? Why, did almost a month pass before the house search was made?
Two indecent images seem like icing on the cake. How indecent were the images? Had he constructed them ab initio himself, or were they 'picked up in passing' from a fetid Internet site? If the former, were these, presumably photographic images, 'snapped' by the defendant, were they 'AI' constructs, or simply drawings based upon imagination?
Why was mention made about the GCHQ policy of 'affirmative action' regarding supposedly 'disadvantaged' groups?
This post has been deleted by its author
When I had friends that worked at GCHQ the only access to the internet was via a sandboxed PC in a room all by itself.
They certainly had to leave their phone in the car as well.
Either things have changed a lot in the last few years, or somebody had their eyes off the ball.
When I read the story on the BBC yesterday it said he copied the data to a work mobile. There will be different zones inside GCHQ where different classes of devices are allowed, from the unsecured zone where people turn up to ask to be allowed in, to the fully secured zone where only devices approved for the Top Secret air-gapped network are allowed. Presumably he was somewhere in between.
What concerns me is the month between him copying the data and his arrest
"What concerns me is the month between him copying the data and his arrest"
It could have been a couple of things. They wanted to see what he did with the information, contacts, social media postings, etc. If the information wasn't too delicate, which a first day should never see, it might have be decided to see where things went. Did he try the same thing again feeling he got away with it the first time? After a month, they might not have been able to keep up the pretense and had to arrest him.
"has pleaded guilty to taking sensitive information home on the first day of his trial."
-> I'm surprised that they still let him have access to such sensitive information given that the charges had progressed all the way to trial.
.
Yes, thanks. Mine's the inconspicuous looking trenchcoat.
"Would the accused, for the benefit of the court, please re-enact what Counsel for the Prosecution has just suggested he did at the time of the alleged offence?
[...]
[...]
Ha! Gotcha! Let the Court note that the accused has fallen for the videamus quam stultus es legal ploy! Guilty!" <bangs gavel>
"Nicely played, m'lud."
"seeking applicants from Black, Asian, mixed heritage, or other ethnic minorities, as well as those from socially or economically disadvantaged backgrounds, since these demographics are underrepresented"
My child is currently trying to find an internship and every single one of them contains a phrase to the effect of "We believe in equal opportunities for everyone, that's why we give priority to (the specific groups mentioned above). Not only is that the exact opposite of "equal for everyone", but surely this kind of diversity box ticking exercise is also illegal under the Equality Act 2010?
It's basically impossible to get into anything unless you are one of the special people.
That's casting a pretty wide net.
So you're white and rich - boo fucking hoo.
Or we don't care what you look like provided you're not from means - Seems fair.
We'll take you if you are well heeled but only if you can tick the quota box as well since you're likely to be the cream of society (Rich and Thick), and we want people to do work.
Have you seen Rory Stuart - he sticks out a bit when they send him to the MiddleEast - so people who might be able to get in, get signals intelligence and get back alive are desirable.
We have many people in the services, we'd like them to get home safely regardless of what damn fool things the Government makes them do, I don't give shit what colour, ableism, gender expression, or non-neurotypical person helps accomplish that task. If your child got a placement, one of the people you decry might be the crucial difference.
Wow. Some people seem to believe that white working-class people living in the South East are rich and stupid and expect special privileges in life. And that they should be denied opportunities that are available to other groups.
The only fair system is to give everybody an EQUAL chance. As soon as you tilt the scales in any direction it becomes an unfair system by definition.
Which conveniently ignores the fact that time and time again people from minorities are discriminated against and NOT given an equal chance - its never been a fair system for THEM. Postive correction Is necessary to correct a flawed system.
It can be proven just by sending a few CV's out that are identical except for the name being brown or white.
The system does give eveyone an equal chance - the statements about encouraging applications from underrepresented parts of the population are intended to avoid situations where people think "Well I would apply for a job there, but there is no point because I don't look like or talk like the other people there, so they wouldn't hire me" Once your in the process, its pretty equitable to all involved (although there are and continue to be incidents of discrimination both positive and negative in individual recruitment processes).
That is simply untrue.
The top universities like Oxford and Cambridge, have lower pass marks on their entrance exams for people from minority groups in order to fulfill their quotas. And those applicants are taking places away from people that are better qualified but don't tick the diversity box.
Sorry, it is your post which is "simply untrue".
It is true that the interview system allows them to consider many factors - not just exam grades. As part of that process, they may take into account whether a candidate has been deprived of the opportunity to fully develop or demonstrate their qualifications.
But this is nothing new. In my day (about 50 years ago) almost everyone applying to do maths had top grades so the interview process was pretty much the only way they selected people. At the time, it was already the case that grammar school kids (like me) had an easier interview process because they had recognized that the public school kids had had a better opportunity to learn how to impress in interviews (and also had specialist teachers to cram for A-levels and for the entrance exam).
So, their attempts to assess who can best benefit from the Oxbridge opportunity have never been based on "pass marks for entrance exams". It's never perfect, of course, as demand massively exceeds supply. But it isn't some modern "diversity" policy, or quotas - just an attempt to assess who really are the best qualified, combined with a lot of luck.
"intended to avoid situations where people think "Well I would apply for a job there, but there is no point because I don't look like or talk like the other people there, so they wouldn't hire me""
Which is true, but only half of it as anyone can be rejected with a statement 'applicant wouldn't fit in to our corporate culture'.
I.e. 'You don't know anyone within the Company and we don't know you, so forget it'.
You've demonstrated the inability to parse content, which is preventing you from gainful employment
Take your CV - put a brown name on the - let's say Saddam Khan. Send the same CV to jobs, see how the results stack up.
If you are working class and any colour - you are disadvantaged - so you'd get quota points, but given you want the world on a plate because you need more suncream, I've a feeling that applying for jobs might feel beneath your levels of entitlement.
I'm from a working class background - only we called it Poor. So take that entitlement and shove it, because money has no smell and those without it live in the same shade of grey, existing but not living well.
those being flippant in their replies to you must be yanks who didn't witness the RAF hiring scandal where qualified white men were explicitly excluded showing that yes this does happen at the government level, and no the candidates aren't told why they were rejected despite exceeding requirements:
https://news.sky.com/story/raf-pauses-job-offers-for-white-men-to-meet-impossible-diversity-targets-12674409
there's so much noise coming from american maga-supporters that honest, sane and legitimate concerns even over here are outright dismissed
I worked in a place where the Founder was ex-service(Army) - the CISO was ex-service (Army), the head of produce was ex-service(RAF) - the person who greeted me on my first day was an ex-Para.
They were hard working, professional fantastic people, and literally to the last one, all White and Male, and overwhelmingly Posh {>75%).
They seems to have done exceedingly well in the forces, despite in one case literally having a fucking ancestral lamb farm that he sent pictures of lambing - ( nlg it looks amazing, so jealous ).
There were a few people from more "middle" background than the above example but it definitely trended up the socio-economic scale.
Interesting people, nothing I did was remotely interesting, all the interesting stuff took place far away on networks, I never saw.
I did boring computer work on AWS - the fancy stuff gets deployed on GovCloud - or MilNet - which I've literally never seen.
"overwhelmingly Posh"
My experience of ex-officers in civvie life is that few of them were raised posh but officer training teaches them to put on an accent and to act overly entitled. Rationale probably that it helps with the chain of command if they appear to the ratings to be one of their "betters". In the commercial world they make great salespeople for the same reason.
I don't know if it makes any difference but I would say they were overwhelming ex-signals.
I've only worked with a few ex-service members, so maybe I've been lucky, but apart from nearly getting in a punch up (which was my fault to be fair) with someone (funny enough he was sales, and v much not Posh, can take the Boy out of Luton..) They've all been really nice. No entitled treatment, but then again I spent the whole time making things work smoothly, so I got on well there, it's handy when you know the tools.
We got a sale pitch from some company and I was rather pointedly asking questions about the difference between that and OS offering like e.g. MetaSploit or other Exploitation / Security tooling.
The idea was that our software should be very secure and able to prove this with audit, not to break into other peoples software, I hasten to add.
I'm on our side of the fence (End customer is MOD)
I'm currently in the royal signals / IT crossover myself and have a few colleagues in the same venn diagram.
None of us are posh though, and those of us that went down the officer route did it for the slightly increased pay and because it seemed interesting rather than because we were in any way privileged (If anything my Northern Irish accent and their scouse ones are quite the opposite of your stereotype). If people self-select not to try out for AOSB because they think it's only for posh people then that's their lookout, that's not a way of thinking that the army in any way promotes (a very small number of exclusive regiments notwithstanding). It's more about throwing yourself around obstacle courses without a care for common sense, running until you vomit your lungs up and showing some awareness for the world around you.
Others (in the combat support arms especially) either reject or back out of the officer role/route because it takes you far away from the hands-on technical roles you probably joined up for in the first place. Same in regular life where you go from dev to management and look jealously at your direct reports having fun in an IDE while you're attending meetings about next year's budget and living in excel hell.
Being in a non-commissioned officer role is the best of both worlds and is often a very conscious decision that shouldn't be translated to any sort of bias. Some people likes sales and excel, some people like tech and just want a senior role in that specific arena.
"They were hard working, professional fantastic people, and literally to the last one, all White and Male, and overwhelmingly Posh {>75%)."
I'd be interested to know if they grew up with two parents, attended public or private schools, that sort of thing. While there are plenty of examples of kids from single family homes that went to a mediocre school winding up doing fine, the real achievers will have had a better start. They will also be expected to meet a certain standard and marry at a certain level as well so their children can do at least as well. That doesn't always work out as I know from family friends where the kids grew up in a wealthy household, married well and their spawn could use regular exorcisms.
This post has been deleted by its author
"For certain security classifications, you need to be a 4th generation British citizen which in the past meant white and now doesn't."
Going by the name, I'm thinking first generation with emigrant parents. 2nd gen plus will often start naming their children with names more usual for the country/region. If they aren't, it can be due to coming from a very narrow enclave that holds themselves somewhat outside of the country norms.
Being poor doesn't make you dishonest, any more than being Rich makes you honest.
It's a joke that you can say this in a country where they steal billions from the coffers and tell you "Mad Vlad, Very Bad, Soz no Money"
Being poor doesn't make you dishonest, any more than being Rich makes you honest.
It's a holdover from the Victorian days where being poor meant that you were lazy/shifless/a crook/subhuman rather than being a victim of a system that ensured all the money went to the "right people". And treated everyone else as disposible garbage.
Oh hi the US.. Sounding familiar?
about 85% of the UK identifies as the majority ethnic group.
These quotes are in place to stop ignorant people pushing out qualified people. If you apply and you don't get the job, the chances of it being because of your skin colour are not high as a white person.
I've been working in the UK since the 1990s, at all scales of business - I've literally never worked somewhere that wasn't overwhelmingly white, and overwhelmingly male.
You are more likely to work with multiple people called Mark, than say a (White) disabled person.
You are less likely to have people from backgrounds that don't start with Mater & Pater greased one into the Alma Mata, before Oxbridge, resulting in no understanding of the customers who use the products we produce, or the reality that the services operate within.
I do a lot of hiring. Tech people mostly, but the odd Civvy. I treat you all fairly because, I'm here to accomplish an aim for money within constraints articulated by the client.
If you're sat in front of me, you had achieve something to be here; that achievement is somewhat mediated by your route.
I understand you think it should be possible to present as "one of the chaps" and be afforded the easy ride, sorry - I won't mark you down but eitheir you can answer correctly or not.
There is also a personal issue, I'm not trying to hire myself, but equally I don't like bigots or bullies, so it's useful to see how they treat people they view as lower status to them. I don't care if you kiss up, I care if you punch down, because I can do that too. I won't have that on my department.
Can't give more than one thumb up but damn I would if I could.
I hire on merit and that alone, our talent acquisition people try to make sure we have applications from under represented groups, not least because there's a great big and deep pool of talent that's being overlooked so we miss out on some of the brightest and best if we don't make extra effort to reach and encourage applications
My best two trainees were randoms
1) I was doing a gig moonlighting for a client's client - my client wanted me to replicate something for their client - okay- The Security guard is complaining about his Son who "spends all day on the bloody computer" - I tell him to send him for interview - Hardworker - turned up with Kali Linux on a laptop - didn't connect to our guest wifi - with a bit of sticky tape on the webcam.
Answered my questions and is now in Germany doing very well ta v much.
2) Transfer from years on the HellDesk - A deep appreciation of why self-healing systems are something that we like
Lovely training him up, he'd just had a baby - so this lovely little toddler would occasionally gurgle in the background or clamber into view.
Hah! AN ARREST!! We are "doing something"!!!
.....Yup......but what other snooping is going on in Cheltenham??
.....All the time....every day snooping on 60 million citizens.......
No.....we can't tell you about that!!
What we can tell you is "that everything that goes on at Hubble Road is 100% within the law!"..............................
Really?? No verification supplied.....
.....but we have arrested a stupid intern................
What if this story is being reported the wrong way around? What if the police identified him and reviewed his personal PC as part of an excercise concerning nasty porn. Then they found material with security caveats that caused them to call in Special Branch & hence the folks in Cheltenham?
Technically, folks with an 'eidetic memory' often got recruited by spooky agencies, or worked for very large corporations though it is rare that such a useful skill isn't put to use. It is said that Turing and many of the folks at 'The Facility' may have been able to do this and were recruited using of all things, crossword and other mathematical puzzles using the not so well known method of informing someone that the problem was unsolvable when in fact it was merely very difficult.
Ability to look at pages of essentially random noise and pick out patterns is a valuable skill, think this is how they originally broke the German codes back in the day with the help of the Polish, later implementing the same method(s) in hardware though having predictable words helped a great deal as it allowed location of individual operators thus valuable context.
Oddly enough the vulnerability of not encoding a letter as itself was later patched, as was adding a secondary layer of encoding (two machines in 'series') which made the pattern nearly impossible to read back without a very powerful computer though later efforts led to code comparison pages being used where operators looked for 3 or more letters in sequence.
The statistical probability of a given letter appearing more than once in n ciphered letters was also a valuable clue and yielded many valuable breaks.
So if someone from one of these "socially or economically disadvantaged backgrounds," decides for financial gain, to compromise or leak something, which idiot who dreamt all this up is going to do serious prison time?
GCHQ runs a regular summer internship program and says it is seeking applicants from Black, Asian, mixed heritage, or other ethnic minorities, as well as those from socially or economically disadvantaged backgrounds, since these demographics are underrepresented at GCHQ.
"GCHQ runs a regular summer internship program and says it is seeking applicants from Black, Asian, mixed heritage, or other ethnic minorities"
But why? If they are looking for people to do field work, they need to look the part and understand the terrain, but an analyst job in an office needs to be competent and trustworthy more than anything else. I don't understand why they think they need to go out of their way to tick boxes.
