Device Policies

Nghia Pho wrote hacking tools for the National Security Agency for nine years, starting in 2006, in the unit that broke into foreign computer networks. Between 2010 and 2015 he took copies of classified material home, and the computer he kept them on was one that none of the NSA's rules for its own computers covered.

An organization writes its device rules down ahead of time as policies: documents that tell everyone who uses the organization's devices what is allowed, what is forbidden, and what is required. They are managerial controls, rules people follow, and a device enforces only the parts someone has also set it up to enforce. The video game studio has three.

The first document, the acceptable use policy, covers what staff do on studio laptops. It forbids visiting gambling sites and game-cheat sites, which often carry malware. It requires staff to accept updates when the laptop asks. It allows drawing tablets, game controllers, and headsets to be plugged in, because the work needs them, and forbids external drives and memory cards, because the code base must not leave the studio on one.

The second document sets the rules for every password at the studio: how long a password must be, how long one may be kept, that old ones may not come back, what it must be built from, and a suggestion to keep passwords in a password manager instead of on paper. The laptops' sign-in settings carry out most of it.

The third document says that staff can't install programs on their own. A list of approved programs is installed by the IT lead, and anyone who needs something else asks for it through a short form.

Ines Halvorsen, a 3D artist at the studio, wants a sculpting program the studio doesn't own. A license costs hundreds of dollars a year, and a game forum offers a cracked copy, one with its license check removed, along with a small tool that switches it on. The artist installs both on a studio laptop over a weekend. Which of the three policies does that break, and which parts of it?

It breaks the third document twice over. Staff aren't permitted to add programs at all, and these two aren't among the ones the IT lead has cleared. Downloading them from a forum also breaks the acceptable use policy if that forum is one of the blocked kinds of site. Tools that switch on cracked programs usually alter the program or the system's licensing files, so anti-malware often flags them, and many carry malware of their own. Cracked programs are one of the commonest ways malware arrives.

The studio's IT lead wipes the laptop, reinstalls it from the studio's standard setup, and changes the artist's passwords in case the tool carried something more. Then Halvorsen fills in the request form: the sculpting program, what it's needed for, and which project. The first answer is no. The producer won't pay for a year's license on a project that ends in six weeks, and points the artist to a free sculpting program already on the approved list. Halvorsen asks again when the next project starts, and that time the studio buys one license, the program goes on the approved list, and the IT lead installs it.

Something like the artist's weekend happened on Nghia Pho's computer at home. News reports identified that computer as the one described in a report Kaspersky Lab published in 2017. According to the report, the computer had Kaspersky's antivirus program on it. In the fall of 2014 the antivirus flagged the NSA hacking tools stored there as malware and, as its settings allowed for new and unknown malware, sent copies to the company's servers, including an archive that also held classified documents. Around the same time, its owner switched the antivirus off to run a pirated activation tool for Microsoft Office that carried a backdoor, a hidden way in for an outsider.

Kaspersky Lab is a Moscow company. On September 13, 2017, three weeks before the first news reports about the home computer, the Department of Homeland Security ordered federal agencies to find Kaspersky-branded software on their computers and remove it. It gave two reasons: ties between some Kaspersky officials and Russian intelligence, and Russian laws under which the country's intelligence services can compel the company's help. In effect it was a software installation policy, written for federal civilian agencies' computers about one company's programs.

Pho had already broken a more basic rule by taking the classified material out of the building. He lost his NSA job in 2015, was charged in 2017, and pleaded guilty in December 2017 to willfully keeping national defense information, and in September 2018 a federal judge in Baltimore sentenced him to 66 months in prison. On his own computer at home, though, no software installation policy applied, and nobody had to approve the pirated tool.