Chris Inglis, the former deputy director of the NSA and the top political official during the Snowden, has shared his personal thoughts and the agency’s mistakes for the first time 13 years after the largest leak of classified documents in the history of the US intelligence community. In an interview with Dark Reading, Inglis acknowledged critical failures in detecting insider threats and the organizational culture that allowed Edward Snowden to exploit the agency’s systems. The revelations are especially important because insider threats remain among the most difficult to address in the cybersecurity space.
See also: NSA uses Anthropic's Mythos despite Pentagon ban
Edward Snowden , a Booz Allen Hamilton employee who worked as an NSA contractor , leaked over 1.7 million classified documents in June 2013 , revealing mass surveillance programs such as PRISM and the collection of metadata from millions of American citizens’ phone calls. The leak caused an international scandal and led to sweeping changes in surveillance legislation with the USA Freedom Act of 2015. The fact that a single person managed to breach the security systems of the world’s most advanced intelligence agency exposed fundamental weaknesses in the approach to homeland security.
According to Inglis , the NSA failed to detect Snowden 's suspicious activities because of critical weaknesses in its security systems. The former official says Snowden took advantage of password sharing among colleagues, the agency's fragmented systems and a lack of systems to detect abnormal behavior. For more than three months , Snowden had access to classified data without arousing suspicion. The situation was exacerbated by an overreliance on security clearances and a lack of monitoring systems that could detect suspicious behavior in real time.
Technical details of the Snowden breach and modern threats
Snowden 's attack did not involve external hacking or exploiting technical vulnerabilities, but was a classic case of insider threat . Snowden used his legitimate access rights as an employee of Booz Allen Hamilton to enter the NSA 's SIPRNet and GWEN networks . He exploited shared administrator accounts with generic passwords and the use of USB drives to extract data from the classified networks. His method demonstrates that the most dangerous threats often come from people who already have legitimate access to the systems and know their weaknesses.
See also: Kraken blackmailed by hackers after internal breach
The lack of Data Loss Prevention (DLP) and User and Entity Behavior Analytics (UEBA) allowed Snowden to conduct suspicious searches and access vast amounts of data without triggering alarms. Manual security checks of the time failed to detect anomalous activities that lasted for months. Today, the NSA has adopted advanced artificial intelligence systems that analyze user behavior and can detect anomalies in real time.
Economic and political implications
Snowden ’s revelations had huge economic and political repercussions that extended far beyond the initial leaks. The NSA spent over $1 billion on security reforms between 2013-2015 , while the international decline in trust led to diplomatic tensions and $35 billion in losses for the U.S. tech industry. The surveillance programs revealed affected over 120 million phone records daily and millions of users worldwide. The loss of trust also led to diplomatic purges and the revision of cooperation agreements between the U.S. and its allies.
See also: Google attributes Axios Supply Chain Attack to UNC1069
Practical advice for modern organizations
Inglis admits that the NSA underestimated the importance of “ enculturation ” – the process of integrating employees into the organizational security culture. He recommends that CISOs focus on insider threat programs that combine technological tools with human factors, such as staff training and collaboration between HR and security departments. Specifically, he suggests adopting a zero-trust architecture , implementing multi-factor authentication across all systems, and installing advanced UEBA systems that can detect anomalous behavior. He also emphasizes the need for regular red-team simulations to prepare for low-probability, high-impact scenarios.
