^ I think the main concern from the US side is that he would reveal to the adversaries the tactic and possibly the technology used by NSA to keep tab on people across the globe.
---
WASHINGTON—The longer that National Security Agency leaker Edward Snowden stays on the run, the greater the danger to national security, U.S. officials say.
Mr. Snowden has said he has more information he may release, and U.S. officials fear that as he looks for refuge, foreign intelligence agencies may have the opportunity to access the material he claims he stole.
U.S. officials believe Mr. Snowden appears not to fully grasp the workings of the surveillance programs he has leaked and other information he may still possess, though foreign intelligence agencies likely have the expertise to make use of it.
"I'm sure the Russians have people who can make sense of it all, given the chance," one U.S. official said.
Officials worry the information he has—both released and not—will damage U.S. intelligence collection efforts.
Teams from the Federal Bureau of Investigation, NSA and other intelligence agencies have been poring over Mr. Snowden's work with NSA contractor Booz Allen Hamilton, interviewing former colleagues, and tracking digital footsteps he left inside the secret computer networks to which he had access.
Based on that investigation, U.S. investigators have formed an outline of the information they believe Mr. Snowden downloaded onto laptops and portable drives using his access as a computer systems administrator, a U.S. law-enforcement official said.
On Wednesday, Mr. Snowden was believed to have spent a fourth day in the transit section of a Moscow airport while authorities in the U.S., Russia and elsewhere haggled over his next move.
The Justice Department has charged Mr. Snowden in a criminal complaint with theft of government property, unauthorized communication of national defense information, and willful communication of classified communications intelligence information.
Mr. Snowden has said that he was behind leaks of documents that exposed NSA programs that collect telephone-subscriber metadata from all major U.S. phone companies, and that monitor foreign Internet and email traffic.
In his two weeks on the run, he has also told of spy operations targeting Russia and China, programs that are hardly surprising but have helped garner sympathy for his plight in those countries.
"These disclosures are going to have consequences," Robert Litt, general counsel at the Office of the Director of National Intelligence said at an American Bar Association panel on Tuesday.
The law-enforcement official said Mr. Snowden, 30 years old, knew how to avoid setting off security alerts that might have drawn scrutiny.
At the same time, his extensive access as an administrator meant that Mr. Snowden could reach into many parts of the computer network.
Mr. Litt said Tuesday that Mr. Snowden appears to have obtained his documents from "the system that the NSA uses to run its business," and not from the operational databases governing the programs he exposed in his leaks.
Such administrative systems are usually more accessible, especially to information-technology specialists who may be called upon to fix network problems. By contrast, the phone-records database can only be accessed by 22 NSA employees.
Mr. Snowden's actions also raised questions about whether the NSA's own security systems are adequate to back up the agency's assurances that it protects the private information it keeps on Americans.
The Office of Director of National Intelligence has for years tried unsuccessfully to link databases across agencies to improve information-sharing while also tightening controls on access.
Among the reasons these efforts fizzled was that the NSA's systems were so disparate that officials couldn't connect the systems within their own agency, a former U.S. official said.
NSA Director Keith Alexander has said he would upgrade security, adding a "two-man rule" in which no one person can access sensitive parts of a network. NSA also is improving its ability to keep track of system administrators' network activity, though former officials say such a system should have been in place already.
Fortune 100 companies use commercially available programs to track employees' computer use, ranging from an IBM program that monitors databases to a Symantec SYMC +1.90% program that tracks the movement and use of confidential data.
In 2007, NSA, which has an estimated 40,000 employees and a roughly $10 billion budget, launched an agency-wide network technology effort to link its networks.
That program was designed to give employees access to all allowed systems—and only those systems—when they signed on at their desks. The planning also included tools to continuously monitor employee network activity and flag suspicious behavior. However, the status of that effort remains unclear, and former officials said the NSA has yet to fully link its systems. An NSA spokeswoman declined to comment on the status of the 2007 effort.
"In this case, you had somebody who apparently was able to use broad credentials to get at data that should have been better protected," said a former senior intelligence official.
"You ought to be able to see everything those guys do from the time they log on to the time they log off. The system should be set up to do that."
http://online.wsj.com/article/SB10001424127887323689204578569980593306000.html