Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Breaches

Air Force Disciplines 15 as IG Finds That Security Failures Led to Massive Classified Documents Leak

Air Force disciplines 15 personnel as the inspector general finds that security failures led to massive classified documents leak.

The Air Force has disciplined 15 personnel in connection with the massive classified documents leak by an airman earlier this year, concluding that multiple officials intentionally failed to take required action on his suspicious behavior, the Air Force inspector general reported Monday.

Massachusetts Air National Guard member Jack Teixeira is accused of leaking highly classified military from the 102nd Intelligence Wing at Otis Air National Guard Base in Massachusetts where he worked.

The punitive actions range from relieving personnel from their positions, including command positions, to non-judicial punishment under Article 15 of the Uniform Code of Military Justice.

Teixeira, who’s 21, has been behind bars since his April arrest on charges stemming from the most consequential intelligence leak in years. He is charged under the Espionage Act with unauthorized retention and transmission of classified national defense information. He has pleaded not guilty, and no trial date has been set.

Prosecutors said in a court filing last week that the two sides have not yet engaged in “substantive” plea discussions.

Teixeira enlisted in the Air National Guard in 2019. He shared military secrets he illegally collected from his intelligence unit with other Discord users, authorities said — first by typing out classified documents he accessed and then sharing photographs of files that bore SECRET and TOP SECRET markings.

In its investigation of the leaks, the Air Force inspector general found both security gaps occurred in part because personnel had access to classified documents without supervision, and because in instances where Airman 1st Class Teixeira was caught violating security policies none of the personnel who either witnessed the violations or had responsibility for Teixeira took the actions necessary in response.

Teixeira worked as a cyber transport systems specialist, essentially an information technology specialist responsible for military communications networks. As such, Teixeira had often unsupervised access as part of a three-person team at night to Top Secret-Secret Compartmentalized facility to perform maintenance inspections. Teixeira remains in the Air National Guard in an unpaid status, Air Force spokeswoman Ann Stefanek said.

Advertisement. Scroll to continue reading.

“At times, members were required to perform preventive maintenance inspections and other tasks, which required individuals to be on their own for hours, unsupervised in other parts of the facility,” the IG found. “Further, no permission controls were in place to monitor print jobs, and there were no business rules for print products. Any night shift member had ample opportunity to access (classified) sites and print a high volume of products without supervision or detection.”

Inside Teixeira’s 102nd Intelligence Support Squadron, members had what the IG described as a “more complete” picture of the breadth of Teixeira’s active unauthorized intelligence-seeking but “intentionally failed to report the full details of these security concerns” because they thought security officials might overreact, the IG found.

For example, in fall 2022 Teixeira was seen writing down notes from a classified document onto a Post-It note. While he was confronted about the note, there was no follow up to ensure the note had been shredded and the incident was not reported to security officers.

It was not until a January 2023 incident that the appropriate security officials were notified, but even then security officials were not briefed on the full scope of the violations.

If any of the personnel had taken the appropriate actions, “the length and depth of the unauthorized and unlawful disclosures by several months,” the IG found.

Those unit officials “who understood their duty to report specific information regarding A1C Teixeira’s intelligence-seeking and insider threat indicators to security officials, intentionally failed to do so.”

But the IG also said the unit’s own policy, which encouraged its tech support service members to attend intelligence briefings “to better understand the mission and the importance of keeping the classified networks operating,” was improper and problematic because it exposed the service members to higher levels of classified material than they needed to know.

The documents released on social media revealed sensitive U.S. intelligence on the Russia-Ukraine war, the Middle East and an array of other topics.

As a result of the security breach, Col. Sean Riley, 102nd Intelligence Wing commander, received administrative action and was relieved of command and the 102nd Intelligence, Surveillance and Reconnaissance Group commander Col. Enrique Dovalo, received administrative action for concerns with unit culture and compliance with policies and standards.

The Air Force also said previously suspended commanders from the 102nd Intelligence Support Squadron and the detachment overseeing administrative support for airmen at the unit mobilized for duty under Title 10 USC were permanently removed.

The Air Force took the intelligence mission from the 102nd after Teixeira’s leaks were discovered and the group’s mission remains reassigned to other units.

Related: Air Force Unit in Document Leaks Case Loses Intel Mission

Related: Online Gaming Chats Have Long Been Spy Risk for US Military

Written By

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Mike Dube has joined cloud security company Aqua Security as CRO.

Cody Barrow has been appointed as CEO of threat intelligence company EclecticIQ.

Shay Mowlem has been named CMO of runtime and application security company Contrast Security.

More People On The Move

Expert Insights

Related Content

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Data Breaches

Delta Dental of California says over 6.9 million individuals were impacted by a data breach caused by the MOVEit hack.

Data Breaches

Sony shares information on the impact of two recent unrelated hacker attacks carried out by known ransomware groups. 

Data Breaches

AT&T is notifying millions of wireless customers that their CPNI was compromised in a data breach at a third-party vendor.

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.