The OPM breach was really, really bad. The OPM response is really, really bad.

The breach was apparently discovered sometime last year (!) when a vendor was doing a product demo on the production network. The idea that a vendor was doing a sales presentation on their production network is terrifying. Nothing to see here!

So far, we're hearing that at least 4 million (but potentially as many as 14 million?!) government employees were affected. Also, not much mention of government contractors, although the second link above speculates on that (OPM says: "No contractors were affected unless they previously held Federal civilian positions."). I'm not comfortable with their confidence, so still waiting for that shoe to drop. I personally haven't heard a peep from Booz Allen. I expect we'll hear more about this soon.

After the breach, OPM contracted with an identity theft company called CSID to provide ID theft protection for all affected government employees. Then, CSID sent the employees a shady looking email from csid.com and as of today, many people still think the email is a phishing attempt. Users were told to delete any email claiming to notify them of the breach. At the same time, OPM published on its website for employees to expect the email from csid.com, and the FTC claims the emails are legit. You can't make this shit up.

Here is Teri Centner's blog post which nicely summarizes the issue.

Here is the announcement from OPM telling users to expect an email from opmcio@csid.com.

Here is the FTC page authenticating the CSID emails.

Edward Snowden's clemency hurdles

I use Grammarly's plagiarism checker because I trust my writing more than yours!

In light of Edward Snowden's recent interview, I thought it might be interesting to take a look at some of the roadblocks that stand in the way of clemency. I should be clear up front that I take no position on whether Edward Snowden should actually be granted clemency. Neither is this post intended to be a policy statement or value judgment about the United States' surveillance operations or capabilities. That being said, these are some of the things that I would consider if I were in a position to make a decision.

First, in a June 12, 2013 interview with the South China Morning Post:

Snowden has admitted he sought a position at Booz Allen Hamilton so he could collect proof about the US National Security Agency's secret surveillance programmes ahead of planned leaks to the media. 

"My position with Booz Allen Hamilton granted me access to lists of machines all over the world the NSA hacked," he told the Post on June 12. "That is why I accepted that position about three months ago."

(Full disclosure: I work at Booz Allen). Having already collected classified documents in his previous job, he quit and took a new job specifically for the purpose of obtaining additional classified information. This is tough to reconcile with the image of a whistleblower. If the goal of a whistleblower is to "exposes misconduct, alleged dishonest or illegal activity," then (at least by his standards), he could have done that without an additional trove of classified documents.

Second, Snowden's motives seem inconsistent with his actions. If his goal was to shine a light on what he perceived as violations of Americans' civil liberties, then the documents he released were far broader than was necessary to achieve that motive. While information on the phone metadata surveillance program certainly relate to the privacy concerns of American citizens, the details of surveillance operations against valid foreign intelligence targets has no rational relationship to American citizens. On the other hand, if his goal was to address the problem of indiscriminate mass surveillance, then the details of those same surveillance operations against valid foreign intelligence targets also miss the mark. While Snowden claims that "[n]ot all spying is bad," it remains to be seen if Snowden (or friendly journalists like Glenn Greenwald) have proffered any evidence of foreign intelligence programs that they support. Snowden seems to suggest that foreign surveillance might violate international law, but I'm not aware of any international obligations that limit the foreign surveillance abilities of the United States (or any other countries' abilities to surveil Americans or other countries).

Third, in an open letter to the people of Brazil, Snowden offered to assist Brazilian senators in investigations of suspected crimes against Brazilian citizens. He said he would be willing to do so where it was "appropriate and lawful," but it's difficult to imagine a circumstance where an American citizen could assist a foreign government in investigating surveillance by the United States against that country (in exchange for asylum), and do so in an appropriate and lawful manner.

Attorney General Eric Holder has rejected clemency as an option. Perhaps the United States government has decided that the hurdles identified above are too high of a climb to overcome.

Words mean things, work edition

A colleague of mine ("Bob") had a form he needed me to sign. Except we don't work in the same building. He works in Building A. I used to work in Building B, but I recently moved to Building C (which isn't owned by our company).

Bob emailed me on a Wednesday and asked me if I was in Building B. I said no, I moved to Building C. However, I told him, if you "send it through the [intra-company] mail, I would stop by Building B and sign it for him. He said that he would do that.

On the next Monday afternoon (after I had already left work), I received an email from the mail room in Building B that I had mail. On Tuesday morning, Bob asked me why I hadn't signed his form yet. I told him that I had only just been notified that the mail arrived, and that I intended to sign it later that day. Bob thought this was unacceptable. Why did I wait to be notified about the mail delivery when he personally dropped it off last Wednesday? This was a time sensitive form (something else he neglected to mention).

Of course, Bob had agreed to "send it through the mail." To me, this meant he dropped off the form via intra-company mail at Building A and it would take a day or two to get to Building B. Under those circumstances, I wouldn't expect the form to be there on Wednesday. But to Bob, dropping it off in person at Building B mail room was just the same as sending it through the mail. And when he dropped it off, he told the mail room attendant that I would be expecting the form, so the mail room attendant didn't email me until Monday (when I hadn't picked up the form in several days).

Words mean things. A simple phrase like "send it through the mail" can mean two different things to different people. In this case, it resulted in a delay of several days. Fortunately, everything was cleared up on Tuesday after several back-and-forth emails. But don't take it for granted that a simple phrase means the same thing to everyone else that it does to you.

One journey ends, another begins

A number of years ago, I began to get requests from people and small businesses to do work for them. I was already gainfully employed, but the work often sounded interesting. So in 2010, I started a small business and made the deal kosher with my then-employer (Booz Allen) by signing some paperwork approving my outside employment and agreeing to avoid conflicts of interest.

To be fair, I never intended to make much money off of this, what was then, a side business. But it would be nice to write a book chapter and get paid, or give a talk and get paid, and have it all be above board. And the work, frankly, was more challenging to me on a technical level. So those two things were really the point of my business.

About a year and half ago, due to a confluence of factors, I started looking to do my business full-time. This was a huge leap of faith for me (as I expect it would be for many people). Going on your own is risky and fraught with potholes. But I needed to do it. So I did--I quit my perfectly good and well-paying job to do it all on my own.

Much of the past year, I had so much work that I had to turn down more work on a regular basis. The infosec industry (at least in the DC metro area) is a buyer's market; the demand for work outstrips the supply. Within reason, you can ask for (and usually get) what you want. In fact, I had three separate contracts ongoing: one which was basically full-time, and two others that were part-time (and one of them, all remote work).

A few months ago, that full-time gig ended rather suddenly. I still had the other part-time work, but it wasn't enough to keep me busy (or pay the bills for very long). So I started looking.

My requirements started out pretty high: #1: 1099 work (many companies won't even look at you if you ask for this) at a comparable rate to what I was already making), #2: MD/DC work; northern VA is increasingly difficult to get to from where I live in MD due to traffic, construction, etc., although remote work would be ideal), and #3: exclusively focused on penetration testing. I have a background in SIGINT and CNE and a clearance, so all those folks jumped aboard, but very few of them met requirement #3. In fact, virtually all of the literally dozens and dozens of people I talked to met one or two of my requirements, but not all three. Asking for just one or even two of these requirements (instead of three), I have absolutely no doubt in my mind I could have found work within a week or two.

But there's another thread to this story, which began in 1997. I was graduating from Bloomsburg and decided to go to law school. I applied to, and was accepted to American University's law school. Very late in that process, I switched gears and decided to get my Master's Degree at Georgetown. So that was the first time I was accepted to law school, but didn't go

Toward the end of my time in the Navy, due to the shrinking size of my community, I decided to do a JAG transfer. Again, I was accepted to law school, but the Navy didn't approve my transfer package. That was the second time I was accepted to law school, but didn't go.

So over the last few years, having regretted not going before, I've been looking for opportunities to go back. And finally, the third time I was accepted to law school, I'm going. Part time, so it'll take four years instead of three, but I refuse to turn it down again.

Back to the present: independent contractor work and school don't get along well. There's travel sometimes, but mostly there isn't always a "regular" workday. Sometimes over the past year, I have worked nights and weekends. When you don't have something else going on, that's not a problem. But again, not really compatible with a school schedule.

So I essentially dropped my 1099 requirement and decided that I could be OK with it in return for the stability of a somewhat regular day job. I'm going back to Booz Allen, but in a different role: I'll be leading one of their penetration testing efforts. Sure, there will be some travel and other issues, but I'm going into it with full visibility and support from my boss, so I know I can make it work.

I will miss the challenges of working on my own--giving all of that up is a sacrifice--and given the circumstances, I would do it again in a heartbeat.

When I was single, I looked at guys who were married (and with kids) and wondered how they did it all. Now I look back and wonder, how could I have done it all without Tracy? She has always been my bedrock of emotional support; never wavering a second. Of this I am truly confident: I could not have done this without her.

In one of those unique circumstances that just seems to work out that way, I start law school and my new job on the same day. How's that for a new journey!

The new job

Almost four years ago, my time in the Navy was quickly coming to a close and I was anxious to find a job.  I gave my first-ever talk at DEFCON about my counter-IED work in Iraq, and in the small crowd of people asking questions, a man flashed his Navy ID card, handed me his contact information, and told me that we needed to talk.

I have to admit at the time I was slightly frightened that somehow my talk had attracted the wrong sort of attention (I was still on active duty at the time, and my talk, while unclassified, was nonetheless pretty aggressive). Ultimately, my apprehension was misplaced; he was in the Navy Reserves but more importantly, he worked for Booz Allen and he was offering me an interview.  I went through a couple of interviews (my first one didn't go so well, but they saw potential and invited me back for a second), and by December I was thrilled to get (and accept) a job with Booz Allen.

Over the past three plus years I have worked with an amazing team of analysts that would be difficult to top. Through the highs and lows, this team has done amazing work and I am proud to have been a small part of it.  Over the course of barely two years, our six member team grew by leaps and bounds (we're about to pass 40 by next month), and it has been a remarkable run. That being said, it was time for a change.

Today, I am happy to announce that I've accepted a new challenge. Effective June 20, I will be working as a Security Engineer and Penetration Tester with TDI Security, a computer security consulting firm based in Washington, DC. I'm working not as an employee of TDI, but as a independent contractor.  Going out on my own and being self-employed is a step I've been looking to make for some time now. While my business (Leverage Consulting & Associates) has been around for over a year now, this move effectively marks the beginning of full-scale operations.

For a while now, I have been looking for the right opportunity to move into more direct full-scope penetration testing work, and I believe that this is that opportunity. Additionally, I already know some of the people I will be working with and I am extremely excited for this new direction.

I've very much enjoyed my time at Booz Allen, and I hope to be able stay in touch with those of you who I've met during that time. I am especially looking forward to meeting new folks through this new role.

See you in Vegas!

Booz Allen going public today under NYSE ticker symbol BAH

From the Booz Allen website:

Booz Allen Hamilton Holding Corporation announced today that it has priced its initial public offering of 14,000,000 shares of Class A common stock at $17 per share. The shares are expected to begin trading tomorrow, November 17 on the New York Stock Exchange under the ticker symbol “BAH”. The underwriters may purchase up to 2,100,000 additional shares at the initial offering price less the underwriting discounts and commissions to cover over-allotments, if any.

Morgan Stanley & Co. Incorporated, Barclays Capital Inc., BofA Merrill Lynch and Credit Suisse Securities (USA) LLC are acting as joint book-running managers of this offering with Stifel, Nicolaus & Company, Incorporated acting as co-lead manager and BB&T Capital Markets LLC, Lazard Capital Markets LLC and Raymond James & Associates, Inc. acting as co-managers.

A registration statement relating to these securities has been filed with and declared effective on November 16, 2010 by the Securities and Exchange Commission. The offering of these securities is being made only by means of a written prospectus forming part of the effective registration statement. A copy of the final prospectus related to the offering will be filed with the Securities and Exchange Commission, which may be obtained, when available, from Morgan Stanley & Co. Incorporated, Attention: Prospectus Department, 180 Varick Street, 2nd Floor, New York, NY 10014, or by email at prospectus@morganstanley.com, or by calling 866-718-1649; or Barclays Capital Inc. c/o Broadridge Financial Solutions, 1155 Long Island Avenue, Edgewood, New York 11717, or by email at barclaysprospectus@broadridge.com, or by calling 888-603-5847.

This press release shall not constitute an offer to sell or the solicitation of an offer to buy nor shall there be any sale of these securities in any state in which such offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any state.

About Booz Allen Hamilton 

Booz Allen Hamilton is a leading provider of management and technology consulting services to the U.S. government in the defense, intelligence and civil markets. Booz Allen Hamilton is headquartered in McLean, Virginia, employs more than 25,100 people, and had revenue of approximately $5 billion in its latest fiscal year.

Police investigate fatal shooting of man, 56, in West Baltimore

From the Baltimore Sun:

Police were investigating the fatal shooting of a 56-year-old man Wednesday night in West Baltimore, a department spokesman said.

Officers responded to the 800 block of N. Brice St., in the Midtown-Edmondson community, about 9:39 p.m., said Detective Kevin Brown, the spokesman.

The victim, identified as Sherman Payne of the 600 block of N. Dukeland St., was taken to Maryland Shock Trauma Center, where he was pronounced dead at 10:39 p.m., Brown said.

Police had no suspects and had yet to determine a motive, according to Brown.

View Larger Map

About me

Last updated: January 23 2020

As of January 2020, I am a Ph.D. student in History at Liberty University.

In December 2019, I received my M.A. in History from Liberty University (Graduate with High Distinction).

Since July 2017, I have been a CNO Analyst and Attorney for Fortego LLC.

From January 2016 until July 2017, I was a law clerk and then an attorney for DLA Piper in Washington, DC.

From 2008-2011 and 2013-2015, I worked for Booz Allen Hamilton  as a Senior Penetration Tester and as a Network Analyst.

In May 2016, I graduated Magna Cum Laude and Order of the Coif from the University of Maryland Francis King Carey School of Law (legal resume).

I previously started and owned a small business, Leverage Consulting & Associates, and through this I worked as a Penetration Tester. My clients included a major international newspaper, the Department of Defense, various other government agencies, private sector businesses, and a number of small businesses in the Washington, DC metro area.

I have contributed to three Syngress books: Penetration Tester's Open Source Toolkit, Vol. 2, Netcat Power Tools, and Kismet Hacking. I also contributed a chapter for a fourth book: Defense against the Black Arts: How Hackers Do What They Do and How to Protect against It.

At my core, I am a hacker at heart. We enjoy breaking things and taking them apart to figure out how they work, how they might do something different, or to discover new ways to use things. We break things not just to break them or for our personal gain, we break them so that they can be made better and more secure.   I was a founding member of Unallocated Space, a central Maryland hackerspace; although I am no longer active there.

Military

I spent nearly 9 years in the United States Navy as an EA-6B Prowler Electronic Countermeasures Officer. During that time, I flew combat missions over Afghanistan and Iraq and participated in Operations Southern Watch, Enduring Freedom, and Iraqi Freedom. I also spent 9 months on the ground in Iraq supporting the Army as an Electronic Warfare Officer supporting the C-IED effort. My awards include the Air Medal (individual action award with Combat V; and strike/flight award), Navy and Marine Corps Commendation Medal (with Combat V), Army Commendation Medal, Navy Achievement Medal, Navy Unit Citation, Navy "E", National Defense Service Medal, Armed Forces Expeditionary Medal, Iraq Campaign Medal, Global War on Terrorism Expeditionary Medal, Global War on Terrorism Service Medal, Sea Service Deployment Ribbon, and the Navy Rifleman and Pistol ribbons. I am also a lifetime member of the Veterans of Foreign Wars (VFW).

Politics

The best description of my politics is that I am a right libertarian. As a young political idealist, I frequently threw ideological bombs with the best of them, but as I have become older I find myself more frequently seeking to promote civility in political discourse (which is increasingly more difficult to find). What's missing, I think, is a basic level of respect for someone else's opinions even if you disagree with them. To use one recent example, Senate Majority Leader Harry Reid (D-NV) said: "I don't know how anyone of Hispanic heritage could be a Republican." This is just pure ignorance, considering that anywhere from 25-30% of Hispanics consider themselves Republican, and upwards of 40% often vote as such. This ignorance exists on both sides of the aisle. You also see it on forums and message boards where people use words like "re-thug" or "demo-rat". In my opinion, you cannot use these words and expect to be taken seriously in any real discussion.

Sports

I am a Philadelphia and Penn State sports fanatic. While I am a fan of all of the major sports teams, I am far more fanatical about the Phillies and Eagles, and less so about the Flyers and Sixers. I held Penn State football season tickets for five years (just gave them up this year, unfortunately). I played football in high school and have been a football coach at the high school level for several years. In addition, I follow some professional cycling, primarily during the Tour de France in July but less so during the rest of the year. I also watch golf (and play very irregularly, and poorly) and most any Olympic sports interest me now and then (even, and especially, curling).

Philomath

I consider myself a practicing philomath, which means that I am a lover of learning, a seeker of knowledge and facts. Learning something new on a regular basis is perhaps deeper to the core of who I am than anything else.

I often spend time searching for things that fascinate me. This is usually a result of reading something on Wikipedia, and then following links to something else, and eventually I end up going off on a tangent and learning about something completely unrelated to what I was originally looking for. Is there a name for this? Wikistumbling. There, I made one. :-)

When I'm reading a book or watching a TV show, I often spend time researching about the locations in the stories. A while back I started watching The Wire (which is a fantastic TV show, by the way), so of course I was fascinated by everything I could find that's related to the show; culture, crime, the neighborhoods, photographs of locations, etc. I tend to invest a lot of time in something until I feel like I have a better understanding of it. Then, I often move on to something else.

Dad and Husband

Last but certainly not least, I am the father of four children and husband to the most wonderful woman in the world. Years ago, before I was married, I often wondered how in the world people could go about their jobs and have a family too. Now I wonder how I could do without it. There is nothing better than coming home from a long day at work to kids yelling "Daddy's home!" and getting a kiss from my wife.

The new job

Last week I started my new job as a Senior Consultant at Booz Allen Hamilton. Without going into a very long and detailed story, I can't really do the job I was hired for until my security clearance is updated. Until then, I'm in a status called "Awaiting Clearance (AWC)." So I'm spending my days doing Computer-Based Training (CBT), lots of reading, and any other sort of training. The goal here is to prepare myself so that I can hit the ground running when I can actually do "the job."

Moving from military to corporate takes some getting used to. I have worn a uniform to work every day of my life for the past 8+ years. Formal functions didn't require formal clothes, because there were always formal uniforms to wear. The end result is that I did not (ever) have very many clothes that were suitable for the corporate environment.

Over the past few months, with the able assistance of my wife, I've finally been able to start assembling some nice clothes. Furthermore, rather than wearing the same uniform every day, I now have to waste brainpower figuring out just exactly what will I wear today? Ok, I admit it, it doesn't require all that much brainpower, but it's still something I am not yet used to doing. And on that thought, it is going to take a while to get used to wearing a dress shirt and tie to work everyday!

End of the line...and the start of something new

First update in a very long while...

I am now on terminal leave from the U.S. Navy and will be officially separating on February 1st. I've known for a while that I wanted to separate, but now the time has finally come.

I'll be changing the name of the blog, although I'm not quite sure what it will be called. The Narmy theme just isn't necessary anymore (and that's a good thing)! Any suggestions?

I had been looking for new jobs since April, and almost reached panic mode this month. Fortunately, I was recently hired to work for Booz Allen Hamilton in Maryland. I'll be starting in February. Cool!