At some point, you have to rely on the competence of the people involved. There really is a whole separate system for discussing sensitive and classified material. People sometimes talk about an “air gap”. In my case, there are three computers on my desk. One for personal use, one for work use, and one for secure use. I have to stick a special chip card into the secure one to log on, and a record of when I log on, and what I access there is kept and probably scrutinized. I can’t access the normal internet on the secure system. If I print something, it has to go to a special printer in a special place, and each page gets entered and noted in a file. If I want to keep a copy, I have to keep it at all times in a government supplied safe. When I am relieved at the end of a mission, all those pages are inventoried by myself and my relief. If a page becomes obsolete, I have to fill out a form attesting that I shredded it, and when, and it has to be a special shredder. There is a whole culture for taking this stuff seriously. The idea of losing documents, or accidentally forwarding them to the wrong people is really frustrating for me. That is why I use the ebola example. When someone talks about putting this stuff on a home server, it is very much like deciding to examine the virus at home, and taking some in an altoids tin, and working on it in a makeshift lab, that your cousin set up in the basement. It just is not done.
All of the trouble that everyone has to go through takes time and effort, but everyone has to learn the system, and agree to play by the rules, before you get a clearance. if there is even a hint that you are not following the rules, the first thing they do is pull everyone’s access while the investigation is happening. I have seen this happen.
But back to your hypothetical. You cannot just send a message from the secure system to an address in the regular world. The person writing the email has broken the law, just by discussing the material on an insecure system. The recipient also has a duty to report seeing such material, or face the same penalties as the sender.
If the hazmat team finds ebola in the makeshift lab, an investigator would probably want to find out who accessed the sample in the isolation room. That person would be out, as would their superiors. Because the ultimate responsibility for safe handling belongs to the manager, who has delegated some portion of authority to the employees. And all of the people tasked with training the proper procedures in the organization would be interrogated, and their training records carefully examined. In this way, secure document procedures are exactly like isolation lab procedures.
Sorry for another very long post.
3 Likes
