Branchoria UFO Hackers UFO Hackers

Documented cyber intrusions, disputed discoveries, and the evidence gaps between them.

Within NASA Targets

How NASA's Open Science Culture Created Security Gaps

Collaboration with universities, contractors and external partners expanded NASA's network while making security practices harder to standardize.

39 sources 3 graphics
Preview for How NASA's Open Science Culture Created Security Gaps

On this page

  • Why NASA Networks Connected So Widely
  • How Contractors Complicated Security
  • The Tradeoff Between Collaboration and Control

Introduction

NASA’s appeal to UFO-motivated hackers such as Gary McKinnon was shaped not only by the agency’s scientific reputation but also by the way it conducted research. Unlike a closed intelligence organisation, NASA relied on extensive collaboration across multiple field centres, universities, commercial contractors and international partners. That model required broad digital connectivity and frequent sharing of technical information, creating a far more distributed computing environment than many outsiders imagined. While there is no evidence that this openness exposed secret UFO archives, it did increase the complexity of securing NASA’s information systems and made consistent security governance more difficult during the late 1990s and early 2000s. Official audits and later policy reforms show that NASA itself recognised this challenge as the agency modernised its cybersecurity programme.[NASA Office of Inspector General]oig.nasa.govNASA Office of Inspector GeneralInformation Technology Security Requirements in NASA Contracts, Grants, and Cooperative Agreements - NASA…

Open Networks illustration 1

Why NASA Networks Connected So Widely

NASA’s mission has always depended on collaboration rather than isolation. Individual centres specialise in different areas—human spaceflight, aeronautics, propulsion, robotics, Earth science or astrophysics—but major programmes routinely involve researchers from several centres alongside universities, private aerospace companies and government laboratories.

This distributed model meant that information systems needed to support:

  • Joint engineering projects across multiple NASA centres.
  • Remote access for scientific collaborators.
  • Contractor participation in spacecraft design and testing.
  • Shared research datasets and mission planning.
  • Public dissemination of scientific results.

Unlike agencies whose work remained almost entirely internal, NASA had strong incentives to make scientific information accessible. Many missions were funded specifically to produce publicly available research, while engineering work often required external expertise that NASA did not possess in-house. This emphasis on collaboration became a defining feature of the agency’s culture and operational model.[NASA]nasa.govOffice of the Chief Information OfficerOffice of the Chief Information Officer - NASAApril 1, 2024…Published: April 1, 2024

For someone searching for hidden UFO evidence, however, this openness could be misinterpreted. The existence of numerous connected systems, research servers and distributed archives created the impression that valuable information might reside somewhere within NASA’s broader network rather than inside a single secured repository.

Gary Mckinnon: The Hacker Who Found UFOs

Channel: Thinker

Open on YouTube

How Contractors Complicated Security

The same partnerships that expanded NASA’s scientific capabilities also expanded the number of organisations handling NASA information.

Large aerospace contractors designed spacecraft components, operated facilities, maintained information technology and supported mission operations. Universities managed research grants, analysed mission data and developed specialised software. Each organisation maintained its own technical infrastructure, administrative procedures and security practices.

From a governance perspective, this created several challenges:

  • NASA information increasingly moved between government-owned and contractor-operated systems.
  • Different NASA centres historically maintained local IT practices before later agency-wide standardisation.
  • Contractors required varying degrees of electronic access depending on project responsibilities.
  • Security responsibilities became shared across organisational boundaries rather than remaining entirely within NASA itself.

These complexities became sufficiently important that NASA’s acquisition regulations established dedicated IT security requirements for contracts involving access to NASA systems or NASA-managed information. Contractors handling NASA data became subject to agency security policies and procedural requirements precisely because the boundary between internal and external networks had become increasingly blurred.[Acquisition.gov]acquisition.gov1804.470 3 it security requirements1804.470-3 IT security requirements. | Acquisition.GOV…

Importantly, this did not mean contractors operated without security controls. Rather, it meant that governance had to extend beyond NASA’s own employees, making consistent implementation more demanding than within a single organisation.

Open Networks illustration 2

The Trade-off Between Collaboration and Control

NASA’s operating model illustrates a classic governance dilemma.

Scientific progress benefits from openness. Engineers need to exchange designs, researchers require access to datasets, and universities contribute specialist knowledge that would be difficult for any single agency to maintain internally.

Cybersecurity, by contrast, generally benefits from limiting access, reducing connections and standardising administrative control.

NASA therefore had to balance competing objectives:

Collaboration goalSecurity consequenceBroad research partnershipsLarger number of authorised usersMultiple field centresDiverse local infrastructuresContractor participationShared responsibility across organisationsScientific data sharingGreater exposure of network servicesPublic scientific missionIncreased external visibility

This balance did not imply poor security by itself. Instead, it increased organisational complexity, making it harder to ensure that every connected system maintained the same security standards.

Later NASA Office of Inspector General reviews explicitly identified the agency’s extensive connectivity with educational institutions, research organisations and the public as factors that increased its exposure to cyber threats while simultaneously making strong cybersecurity essential for mission success.[NASA Office of Inspector General]oig.nasa.govOffice of Inspector General NASA's Cybersecurity Readiness (IGNASA Office of Inspector GeneralNASA's Cybersecurity Readiness (IG-21-019) - NASA OIG…

Hearing: NASA Cybersecurity An Examination of the Agency's Information Security

Channel: House Science, Space, and Technology Committee

Open on YouTube

Why This Mattered During the McKinnon Period

Gary McKinnon’s intrusions occurred during a period when federal cybersecurity practices were still maturing across many agencies. Networks were generally less centralised, remote administration tools were more widely exposed than would later become acceptable, and enterprise-wide security management was still evolving.

NASA’s own Inspector General later documented multiple weaknesses requiring improvement, including inconsistent implementation of security practices across important systems. Earlier audits also examined shortcomings in how information security requirements were incorporated into contracts and cooperative agreements, reflecting recognition that security governance needed to keep pace with NASA’s collaborative operating model.[NASA Office of Inspector General]oig.nasa.govNASA Office of Inspector GeneralInformation Technology Security Requirements in NASA Contracts, Grants, and Cooperative Agreements - NASA…

This broader institutional context helps explain why McKinnon was able to compromise multiple computers across several NASA centres. The official record attributes the intrusions to security weaknesses rather than to the existence of hidden research networks or special UFO databases.

Gary McKinnon Interview - BBC

Channel: The Proud Patriot

Open on YouTube

Open Networks Did Not Mean Hidden UFO Repositories

A common misunderstanding is that NASA’s broad research connectivity implied the existence of an agency-wide network containing extraordinary classified information accessible from ordinary administrative systems.

The available evidence does not support that conclusion.

NASA’s collaborative infrastructure connected many legitimate scientific and engineering resources, but these systems served routine mission operations, research partnerships and administrative functions. Official investigations into the McKinnon case confirmed compromises affecting computers at multiple NASA centres but did not report the discovery of secret extraterrestrial programmes or concealed spacecraft records. Likewise, McKinnon’s own public claims about viewing unusual files have never been independently verified through preserved documents, authenticated system records or corroborating forensic evidence.

The significance of NASA’s open research model therefore lies not in validating UFO claims, but in explaining why such a large scientific organisation presented a broader and more complex attack surface than many government agencies. The same openness that accelerated research also demanded increasingly sophisticated cybersecurity governance—an evolution reflected in NASA’s later agency-wide information security policies, contractor requirements and modern Office of the Chief Information Officer strategy.[nasa.gov]nodis3.gsfc.nasa.govdisplay Dir.cfmNPD 2810.1F - main…

Open Networks illustration 3

Amazon book picks

Further Reading

Books and field guides related to How NASA's Open Science Culture Created Security Gaps. Use these as the next step if you want deeper reading beyond the article.

Browse more on Amazon:Dark Territory: The Secret History of Cyber WarThe Cuckoo's Egg: Tracking a Spy Through the Maze of Computer EspionageCountdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon

As an Amazon Associate I earn from qualifying purchases.

eBay marketplace picks

Marketplace Samples

Live-tested eBay searches with available results related to this page.

UsingUSA

Selected fromNASA poster oneBay.co.uk.

Browse more oneBay.co.uk

Example items shown for inspiration; availability and pricing can change. Branchoria may earn a commission if you purchase through outbound eBay links.

Endnotes

1. Source: oig.nasa.gov
Link:https://oig.nasa.gov/office-of-inspector-general-oig/ig-01-043/

Source snippet

NASA Office of Inspector GeneralInformation Technology Security Requirements in NASA Contracts, Grants, and Cooperative Agreements - NASA...

2. Source: oig.nasa.gov
Title: Office of Inspector General NASA’s Cybersecurity Readiness (IG-21-019)
Link:https://oig.nasa.gov/office-of-inspector-general-oig/ig-21-019/

Source snippet

NASA Office of Inspector GeneralNASA's Cybersecurity Readiness (IG-21-019) - NASA OIG...

3. Source: nodis3.gsfc.nasa.gov
Title: display Dir.cfm
Link:https://nodis3.gsfc.nasa.gov/displayDir.cfm?c=2810&s=1E&t=NPD

Source snippet

NPD 2810.1F - main...

4. Source: nasa.gov
Title: Office of the Chief Information Officer
Link:https://www.nasa.gov/ocio/

Source snippet

Office of the Chief Information Officer - NASAApril 1, 2024...

Published: April 1, 2024

5. Source: acquisition.gov
Title: 1804.470 3 it security requirements
Link:https://www.acquisition.gov/nfs/1804.470-3-it-security-requirements

Source snippet

1804.470-3 IT security requirements. | Acquisition.GOV...

6. Source: acquisition.gov
Title: part 1804—administrative matters
Link:https://www.acquisition.gov/index.php/nfs/part-1804%E2%80%94administrative-matters

7. Source: oig.nasa.gov
Link:https://oig.nasa.gov/office-of-inspector-general-oig/ig-11-017/

Source snippet

NASA Office of Inspector GeneralInadequate Security Practices Expose Key NASA Network to Cyber Attack (IG-11-017) - NASA OIG...

8. Source: nasa.gov
Title: About the OCIO
Link:https://www.nasa.gov/about-the-ocio/

Source snippet

IT Mission We empower NASA’s people and partners to achieve mission success through...

9. Source: nasa.gov
Title: Cybersecurity Policies
Link:https://www.nasa.gov/cybersecurity-policies/

Source snippet

July 17, 2026 — CYBERSECURITY POLICIES If you wish to report a cybersecurity incident or concern, please contact the NASA Security Op...

Published: July 17, 2026

10. Source: nasa.gov
Title: Vulnerability Disclosure Policy
Link:https://www.nasa.gov/vulnerability-disclosure-policy/

11. Source: oig.nasa.gov
Link:https://oig.nasa.gov/audits/

12. Source: nodis3.gsfc.nasa.gov
Title: display Dir.cfm
Link:https://nodis3.gsfc.nasa.gov/displayDir.cfm?c=2540&s=1H&t=NPD

13. Source: nasa.gov
Title: System-Wide Safety Collaborations
Link:https://www.nasa.gov/directorates/armd/system-wide-safety-collaborations/

14. Source: oigforms.nasa.gov
Link:https://oigforms.nasa.gov/testimony.html

15. Source: nodis3.gsfc.nasa.gov
Title: display Dir.cfm
Link:https://nodis3.gsfc.nasa.gov/displayDir.cfm?Internal_ID=N_PD_2810001F&page_name=main

16. Source: oig.nasa.gov
Link:https://oig.nasa.gov/office-of-inspector-general-oig/ig-21-022/

17. Source: oig.nasa.gov
Link:https://oig.nasa.gov/office-of-inspector-general-oig/ig-19-002/

18. Source: oig.nasa.gov
Link:https://oig.nasa.gov/office-of-inspector-general-oig/ig-18-019/

19. Source: oig.nasa.gov
Link:https://oig.nasa.gov/office-of-inspector-general-oig/ig-18-020/

20. Source: data.nasa.gov
Title: it policies and standards nasa information security policy
Link:https://data.nasa.gov/dataset/it-policies-and-standards-nasa-information-security-policy

21. Source: nodis3.gsfc.nasa.gov
Title: display CA.cfm
Link:https://nodis3.gsfc.nasa.gov/displayCA.cfm?Internal_ID=N_PR_2810001A&page_name=Chapter4

22. Source: oig.nasa.gov
Link:https://oig.nasa.gov/office-of-inspector-general-oig/ct-2003-1/

23. Source: nodis3.gsfc.nasa.gov
Title: display CA.cfm
Link:https://nodis3.gsfc.nasa.gov/displayCA.cfm?Internal_ID=N_PR_10000003&page_name=4.24

24. Source: nodis3.gsfc.nasa.gov
Title: display CA.cfm
Link:https://nodis3.gsfc.nasa.gov/displayCA.cfm?Internal_ID=N_PR_28100001&page_name=Chapter2

25. Source: nodis3.gsfc.nasa.gov
Title: display All.cfm
Link:https://nodis3.gsfc.nasa.gov/displayAll.cfm?Internal_ID=N_PR_28000001&page_name=ALL

Additional References

26. Source: nsa.gov
Link:https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/

27. Source: nsa.gov
Link:https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/Fusion-Operations/

28. Source: youtube.com
Title: How a 15 Year Old Teenager Hacked NASA
Link:https://www.youtube.com/watch?v=icsw39Hc_HE

Source snippet

Gary McKinnon NASA hack cyber security Gary Mckinnon: The Hacker Who Found UFOs Thinker...

29. Source: gao.gov
Link:https://www.gao.gov/assets/a296860.html

30. Source: youtube.com
Title: Gary Mckinnon: The Hacker Who Found UFOs
Link:https://www.youtube.com/watch?v=8_1DuqeU8hw

Source snippet

Hearing: NASA Cybersecurity An Examination of the Agency's Information Security...

31. Source: youtube.com
Title: Gary Mc Kinnon Interview
Link:https://www.youtube.com/watch?v=XacevWeOkHg

Source snippet

Hacking for UFOs and fighting for his life. Who is Gary McKinnon? | NordVPN...

32. Source: youtube.com
Title: Hacking for UFOs and fighting for his life. Who is Gary Mc Kinnon? | Nord VPN
Link:https://www.youtube.com/watch?v=OImdnvQx7sQ

Source snippet

How a 15 Year Old Teenager Hacked NASA...

33. Source: youtube.com
Title: Hearing: NASA Cybersecurity An Examination of the Agency’s Information Security
Link:https://www.youtube.com/watch?v=XwIbUgpC4rY

Source snippet

Gary McKinnon Interview - BBC...

34. Source: arxiv.org
Title: arXiv Outcome-Driven Open Innovation at NASA
Link:https://arxiv.org/abs/1810.03426

35. Source: spaceref.com
Title: NAS A OIG Audit Report: Security of a NASA Center’s Computer Network
Link:https://spaceref.com/status-report/nasa-oig-audit-report-security-of-a-nasa-centers-computer-network/