The question of how Bradley Manning — a 22-year-old Army intelligence analyst with documented psychological problems and a history of concerning behavior observed by supervisors — was able to download hundreds of thousands of classified diplomatic cables and military documents and transmit them to WikiLeaks exposes a series of institutional failures whose individual elements were unremarkable but whose combination proved catastrophic.

The physical security failure was basic. Manning had authorized access to the Secret Internet Protocol Router Network, a classified government intranet. He used that authorized access to download enormous quantities of data to a CD-ROM labeled as a Lady Gaga album. No system on the classified network flagged the volume or nature of the download; no supervisor reviewed what he was doing.

This was partly a consequence of the post-9/11 intelligence reforms that had explicitly broken down the barriers between intelligence agencies to prevent the kind of siloing that had prevented intelligence agencies from connecting the dots about the 9/11 plot. The reforms had succeeded in creating a more connected system; that connectivity had its own failure modes, which the post-9/11 reform architects had not fully anticipated.

Manning's personal situation should have triggered more scrutiny. His supervisors were aware of his emotional instability; there were documented incidents of concerning behavior. But the Army's systems for flagging individuals with elevated security risk on an ongoing basis — as opposed to the background check conducted at initial clearance — were inadequate.

What WikiLeaks demonstrated was not that government secrecy is unjustifiable but that the systems designed to enforce it were not engineered for the threat posed by authorized insiders with external motives. The external hackers that cybersecurity focused on were not the problem. The insider with legitimate access was.