The EMCO Case: The Political Responsibility of National Defense

El Mostrador, September 25, 2022

It is appropriate for General Paiva to resign due to his command responsibility, as he was the senior officer in charge of EMCO (…) Where doubts remain is regarding political responsibility, which in this case lies with the Minister of Defense, Ms. Maya Fernandez. For all intents and purposes, she is the highest authority and ultimately responsible for everything good and bad that occurs in the Ministry of Defense, its departments, and dependent institutions. All indications are that she, with the assistance of her new Undersecretary of Defense, is taking all necessary actions, but we do not know if she should have taken them earlier as soon as the existing weaknesses were known, or if the internal control and audit bodies of her ministry acted correctly, whether when the control weaknesses were reported or in the internal control reviews conducted prior to this incident.

At the time of writing this column, General Paiva had resigned 24 hours earlier from the position of Chief of the Joint Staff (JEMCO) due to the leak of emails that had affected the department he had led since the early days of March 2022.

The very recent email leak appears to have resulted from a hack of EMCO’s email server, and General Paiva’s resignation is all we know for certain, as the conclusions of the administrative investigations will take time, as will any potential judicial aspects that may arise.

It seems that General Paiva’s resignation is due to his command responsibility, but it is unclear whether it was entirely voluntary or induced by the minister or other related authorities. What is clear is that at the time of the email leak by hackers, General Paiva had been in charge for just over five months, and approximately two months in command at the time the security incident is believed to have occurred; this last point needs confirmation, but all indications suggest it took place in May 2022.

It is correct for General Paiva to resign due to his command responsibility, as he was the senior officer in charge of EMCO. He took on the position in due time and cannot blame external factors unless it is demonstrated that he was aware of and reported to his superior, the Minister of National Defense, the vulnerabilities and potential information security incidents to which the weaknesses of the computer systems of the unit he commanded exposed them.

Command responsibilities end with the officer in charge and do not affect those who preceded them in the position. However, the administrative investigation should shed light on errors made in the past and present, as well as the improvements required in the technological environment of the affected department. The important thing is that rather than creating a witch hunt, there should be learning and improvement in the cybersecurity of the Ministry of Defense and its dependent departments.

Where doubts remain is regarding political responsibility, which in this case lies with the Minister of Defense, Ms. Maya Fernandez. For all intents and purposes, she is the highest authority and ultimately responsible for everything good and bad that occurs in the Ministry of Defense, its departments, and dependent institutions.

All indications are that she, with the assistance of her new Undersecretary of Defense, is taking all necessary actions, but we do not know if she should have taken them earlier as soon as the existing weaknesses were known, or if the internal control and audit bodies of her ministry acted correctly, whether when the control weaknesses were reported or in the internal control reviews conducted prior to this incident.

Security incidents like the one that occurred at EMCO happen even in the best private companies and government organizations in the world, and when they occur, they often lead to the downfall of those in charge, as the public disclosure of information subject to confidentiality will always cause controversies and even potential legal issues. Depending on the severity or importance of what is made public, the extent of the fallout will vary, something that in the case of EMCO will only be fully understood once the administrative investigation is completed, including the review of the emails leaked by the hackers, which are already generating interesting controversies due to the nature of the topics discussed.

Regardless of what some media report, it is very unlikely that there is classified information involved, as that typically does not circulate via email and is safeguarded in isolated means not connected to networks that could be hacked.

The absence of risk that classified information is affected does not imply that the investigation should be less rigorous or thorough; however, it does mean that it should be led by specialists in cybersecurity and information technology, ideally those who are not part of departments under the Ministry of Defense, as the latter must also be subject to investigation for its political and administrative responsibilities.

Regardless of his professional qualifications and experience, having the head of Army intelligence, who holds a master’s degree in systems engineering, in charge of the investigation by a two-star general on active duty has clear limitations due to his position in the hierarchy of generals and what that implies when reviewing what went wrong and the actions of political authorities and more senior generals. Such investigations should be the responsibility of the Comptroller General of the Republic due to its independence from the subjects of the investigation.

If there is one expectation of political authority, it is to ensure maximum transparency in the investigation of what occurred, as otherwise, she is doing a disservice to herself and the ministry she leads. If the administrative investigation is left as it is, doubts may remain about whether the whole truth will come out, and therefore the lessons learned may not be truly valid for generating substantial improvements in the cybersecurity environment of EMCO and other equivalent departments of the Ministry of Defense.

It is surprising that every time there are problems in Defense, only general officers pay the price, and never any of the related political authorities. This is despite the fact that the latter are so concerned about being effectively in charge of the Armed Forces, a concern that evaporates whenever adverse situations arise. The day they take responsibility for everything that happens in the Ministry of Defense, they will be able to say they are truly in charge.

Finally, mitigating or eliminating incidents like the leak of EMCO’s emails requires good control environments, independent internal auditors, specialists in information security and cybersecurity, and a corporate governance structure that includes responsibilities such as auditing and internal control, risk matrices, and technological and information security risks.

Richard Kouyoumdjian
Vice President AthenaLab

Source: El Mostrador