Sub CO flouted security rules, lost command - Navy News | News from Afghanistan & Iraq - Navy Times

Sub CO flouted security rules, lost command

Cmdr. Michael Varney had a spotless career. The 45-year-old submariner led rebuilding efforts in a dangerous province of Afghanistan, earned a Bronze Star and was the commander of the attack submarine Connecticut, successfully leading the Seawolf-class sub on multiple deployments.

That was until he sat down on the morning of Jan. 31 for a routine security interview. As part of the security check, a special agent with the Naval Criminal Investigative Service asked him questions about his handling of classified materials.

During the interview, Varney revealed that he had brought classified information home once or twice a year, a situation that normally requires the authorization of a fleet commander or the chief of naval operations. Sensing a possible violation, the agent began asking more questions.

Varney said he had a portable hard drive at home with files from his time in Afghanistan, and that some of those files may be classified. The agent noted the time as 8:34 a.m.

Varney’s admission triggered a four-month investigation, led by NCIS and Submarine Development Squadron 5, which found Varney mishandled classified material, then hid evidence of it and lied to investigators. They discovered 39 classified files — 35 of them marked “secret” — on his unmarked personal hard drive, kept at his Gig Harbor, Wash., home.

Varney initially denied many of these conclusions and then later had to clarify himself as the probe expanded. He was fired June 6, the 12th commanding officer to be sacked this year and the first submarine captain. He is the first CO relieved for the mishandling of classified materials in years.

The Navy has had 409 cases of “electronic spillage” this fiscal year, approaching the total of 493 cases they had in fiscal 2010, according to Naval Network Warfare Command. Privately purchased removable media, such as USB devices, are prohibited in classified Defense Department systems, per a February Joint Chiefs instruction.

There is no evidence that Varney shared the information with others, and he told investigators he had been the only one to use his laptop and that the hard drive hadn’t left his possession. The command investigation assessed the chances of the secret materials being compromised as “remote” and characterized the threat to national security as “minimal.”

Navy Times obtained the command investigation through a Freedom of Information Act request. The Navy redacted personal details such as names and ranks from the report. Records of the questions investigators asked were not disclosed in the report. Calls and emails seeking comment from Varney were not returned.

The following is based on that report.

‘To get the job done’

The sleek device that led to his firing had been purchased with the best of intentions. Varney bought a Western Digital 80-gigabyte external hard drive right before deploying to Afghanistan in early 2006. The device helped him back up the files on the personal Hewlett-Packard laptop he had also brought.

Varney traveled frequently in Afghanistan. Once a month, he flew from Paktika province, where his 100-person team was based, to Bagram Air Base for briefings. For each one, he produced a PowerPoint briefing on a classified computer and then saved it to his hard drive, which he brought on the flight in his pocket or backpack. He did this “out of convenience, to get the job done,” he later told the special agent April 28. These briefings accumulated on his portable drive.

His tour as the provincial reconstruction team commander was successful. In a speech in April 2006, Adm. Mike Mullen, then the chief of naval operations, hailed him as a leader in the mold of Fleet Adm. Chester Nimitz, one of a list of “leaders who serve nobly where needed.”

Varney returned to the U.S. in April 2007, after a year on the ground leading the PRT. The 1990 Naval Academy graduate had previously been selected for command and entered the command pipeline later that year. He took command of the Bangor, Wash.-based Connecticut in early 2009.

Varney hadn’t followed classification protocol in Afghanistan, which mandated the tracking of classified storage devices and their labeling with a red sticker marked “secret,” investigators later determined. In addition to the unmarked hard drive, he told investigators that he had also carried a CD with classified materials between Middle Eastern countries without the required courier card. However, investigators noted that commanders in a combat zone have some leeway on the handling of classified information.

But Varney brought the hard drive home with the classified files still saved to it.

The ease-of-use and storage space that USB devices provide pose challenges for information security, according to a security manager.

“In the classified arena, you’ve got the potential to move things from classified to unclassified and vice versa, quickly and easily,” said Brandon Champion, information technology security manager at the nonprofit Center for Naval Analyses. If a device is lost and the files on it are not encrypted, he continued, the risk is that these files are “going to be easily readable by whoever picks it up.”

The circumstances under which Varney admitted he may have mishandled classified materials to the NCIS special agent Jan. 31 are unclear from the report. But once he did so, NCIS immediately asked for permission to search his home and possessions. Varney consented.

Agents searched his black BMW M3 in the parking lot. Then they followed him to his Gig Harbor home, where they combed through his personal office upstairs. Varney had said that he had not connected his hard drive to his personal Apple MacBook laptop, but an agent searched anyway, using the keyword “navy.” Fifteen files returned, none of them classified. They then seized his external hard drive.

NCIS forensic analysis found 35 secret and four confidential files on the storage drive. Submarine Development Squadron 5 reviewed the files and determined that their classification level was correct. A second review concurred. While this was going on, Connecticut deployed Feb. 27 under Varney for two months. The day after it returned, April 28, NCIS interviewed Varney again.

Confronted with findings from the hard drive scan, Varney acknowledged some errors.

He had connected his external hard drive to the MacBook, after previously denying it. He couldn’t recall whether he’d mailed or carried the hard drive back to the U.S. He didn’t remember how one of the classified files had been saved to it.

He said he “never really thought the PowerPoints contained classified information, even though they were produced on a classified computer”; in the same interview, he said that he “was not worried” if they had. The information would likely have been declassified by now anyway, he said.

With Varney’s consent, NCIS took custody of the MacBook and another personal computer. They found the portable hard drive had been connected to the MacBook four times, in October and November of 2009, and that the classified files had been deleted using a “secure empty trash” program that hid when and who erased the files. But, deep in the logs of the operating system and user preference files, investigators found records of the classified documents.

Shown this evidence May 26, Varney responded that he hadn’t known that there were classified files on his MacBook until that day when NCIS told him and that he “did not intentionally delete any classified files” from the computer.

These contentions didn’t sway the investigators. Varney had lied to them and “wrongfully interfered with this investigation by deleting classified files,” the report concluded. Moreover, “given the relatively small amount of materials that he brought back to the United States after completing his tour,” the investigators wrote, “it seems unlikely that this was an oversight and much more likely that he intentionally brought it back.”

“The probability of compromise is remote and the threat to national security minimal,” the report states. “However, a security vulnerability was revealed due to the failure of Cmdr. Varney to comply with established security regulations.”

On June 6, Varney received nonjudicial punishment for making a false official statement, interfering in an adverse administrative proceeding and failure to obey a lawful general order. Capt. Brian Howes, commander of Submarine Development Squadron 5, stripped him of his command of Connecticut. Varney was reassigned to Navy Region Northwest.