Robert Hanssen and FBI Security Failures: Lessons Learned

Introduction: A Twenty-Two-Year Breach of Faith

Over the course of twenty-two years, from 1979 to 2001, Robert Hanssen participated in what is possibly the most severe breach of national intelligence in United States history. Through a combination of skill and sheer luck, Hanssen was able to pass critical information from his position at the FBI to Soviet and later Russian intelligence agencies — information that may have contributed to the capture and execution of a number of individuals. Hanssen's case is particularly interesting because it unfolded across two decades that included the end of the Cold War and the dawn of the internet age. Examining the various means by which Hanssen was able to breach security therefore offers special insight into the security threats, both new and old, that face those tasked with protecting sensitive government information.

Ultimately, the Hanssen case reveals a number of ongoing vulnerabilities in the safeguarding of sensitive government information. Although the FBI adapted its security functions in response to developments of the last thirty years, that response has been characterized by the same underlying structural and cultural problems that created the original intelligence and security failures.

Vulnerabilities That Enabled Hanssen's Espionage

Hanssen's breach was so successful that in its aftermath, the Justice Department ordered a comprehensive review of the FBI's security programs in order to identify which policies and procedures needed to be changed or updated to confront the kind of threat he embodied. Many of the specific vulnerabilities that allowed Hanssen to access highly sensitive information and pass it to the Soviet Union and, eventually, Russia were outlined in the report compiled by the Commission for Review of FBI Security Programs — also known as the Webster Commission, after its chairman William H. Webster. The Commission characterized the scale of the disaster plainly, noting that it "was established in response to possibly the worst intelligence disaster in U.S. history: the treason of Robert Hanssen, an FBI Supervisory Special Agent, who over twenty-two years gave the Soviet Union and Russia vast quantities of documents and computer diskettes filled with national security information of incalculable value" (Webster, 2002, p. 1).

First and foremost, Hanssen's success represents a failure at the basic level of physical security. Although some of the information he sold was acquired through his skill with computers, a major reason he went undetected for so long was that he could simply "walk into Bureau units in which he had worked some time before, log on to stand-alone data systems, and retrieve, for example, the identities of foreign agents whom U.S. intelligence services had compromised, information vital to American interests and even more immediately vital to those whose identities Hanssen betrayed" (Webster, 2002, p. 1). Controlling who can physically access each machine is one of the most basic steps in securing sensitive information, yet according to the Webster Commission report, "Bureau personnel routinely upload classified information into widely accessed databases, a form of electronic open storage that allows essentially unregulated downloading and printing" (Beale, 2007, p. 22; Webster, 2002, p. 4).

Hanssen also exploited the FBI's complete lack of any behavioral analysis or anomaly detection program. As the Webster Report notes, an information-system auditing program — which works by detecting anomalies as "current host activity is gauged and compared to a statistical baseline, or threshold, of known activity for that host" — "would surely have flagged Hanssen's frequent use of FBI computer systems to determine whether he was the subject of a counterintelligence investigation" (Webster, 2002, p. 4; Trost, 2010, "Network Flows and Anomaly Detection"). Because Hanssen had himself developed many of the information systems used by the Bureau, he was ideally placed to exploit any weaknesses or shortcomings within them.

Organizational and Cultural Roots of FBI Insecurity

One of the most damning conclusions of the Webster Commission's report was its finding that there are "significant deficiencies in Bureau policy and practice," and that "those deficiencies flow from a pervasive inattention to security, which has been at best a low priority" — at least until something dramatic, such as the arrest of Robert Hanssen, forces the issue (Webster, 2002, p. 1). This finding is critical because it demonstrates that blame for Hanssen's breach must rest not only with Hanssen himself and the specific vulnerabilities he exploited, but also with the organizational culture, management practices, technology, and procedures that together produced a culture of insecurity in which warning signs could be ignored for years.

The Webster Commission located the source of this pervasive insecurity in the inherent tension between the FBI's law-enforcement and intelligence operations — two missions that sometimes demand entirely different goals, standards, and procedures, especially regarding the sharing of information. The report notes that "until the terrorist attacks in September 2001, the FBI focused on detecting and prosecuting traditional crime, and FBI culture emphasized the priorities and morale of criminal components within the Bureau" (Webster, 2002, p. 1). Problems arose because "this culture was based on cooperation and the free flow of information inside the Bureau, a work ethic wholly at odds with the compartmentation characteristic of intelligence investigations involving highly sensitive, classified information" (Webster, 2002, pp. 1–2). As a result, "operational imperatives will normally and without reflection trump security needs," such that, for example, "senior Bureau management recently removed certain security-based access restrictions from the FBI's automated system of records, the principal computer system Hanssen exploited, because the restrictions had hindered the investigation of the terrorist attacks" (Webster, 2002, p. 2).