I Learned IT from Watching You, DoD

The FBI's failed, half-billion dollar attempt to bring its case file management system into the late twentieth century has been a spectacular failure, but it did net the feds one criminal: a consultant who got so fed up with the paperwork surrounding the project that he hacked open 38,000 FBI passwords, including the one belonging to FBI Director Robert S. Mueller III.

Those passwords would have gotten Colon access to files on the Witness Protection Plan.

That's according to a story from Eric Weiss of the Washington Post.

The BAE Systems contractor, Joseph Colon, could get up to 18 months in the pokey, now that he has pleaded guilty to four counts of intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States. Not surprisingly, the feds pulled his top-secret clearance and he also got fired.

According to Colon's plea, he entered the system using the identity of an FBI special agent and used two computer hacking programs found on the Internet to get into one of the nation's most secret databases.

Colon used a program downloaded from the Internet to extract "hashes" – user names, encrypted passwords and other information – from the FBI's database. Then he used another program to "crack" the passwords by using dictionary-word comparisons, lists of common passwords and character substitutions to figure out the plain-text passwords. Both programs are widely available for free on the Internet.

Colon's lawyer said in a court filing that his client was hired to work on the FBI's "Trilogy" computer system but became frustrated over "bureaucratic" obstacles, such as obtaining written authorization from the FBI's Washington headquarters for "routine" matters such as adding a printer or moving a new computer onto the system. He said Colon used the hacked user names and passwords to bypass the authorization process and speed the work. [...]

While Trilogy led to successful hardware upgrades and thousands of new PCs for bureau workers and agents, the final phase – a software system called the Virtual Case File – was abandoned last year. The FBI announced in March that it would spend an additional $425 million in an attempt to finish the job. The new system would be called "Sentinel."

I know if I had to fill out paperwork to add a printer to my network, I'd be one pissed off guy.† But I'm pretty sure I would know better than to use warez cracking tools on an FBI password database.† Really, a smart hacker would find a way easier workaround than that.

By the way, if a three-letter government agency got frustrated with bureaucracy and thus decided to secretly find another, not-clearly legal way of getting at their job done (and in the process, got at the information of a lot of people they shouldn't have), would they be prosecuted for intentionally accessing a computer while exceeding authorized access and obtaining information on any citizen of the United States?

Just wondering, ya know?