In 2007, Congress passed a law requiring military and intelligence agencies to install audit capabilities and access controls on classified systems, Collins noted. "Those technologies ... are not new," she said. "They're widely used. The serious cyber risk associated with removable media devices, such as thumb drives, has been known for many years."

The DOD began installing on its computers in the U.S in 2008, but it was more difficult to install those security measures on computers in Iraq because of the variety of equipment, Ferguson said. "A lot of the systems there are, for lack of a technical term, cobbled together," he said. "It's sort of a family of systems there."

Collins also asked how Manning had access to classified State Department diplomatic cables about countries that weren't involved in the Iraq war. Several years ago, the DOD asked for State Department documents to be included on SIPRNet as a resource for military members, said Patrick Kennedy, under secretary for management at the State Department.

"We believe, in the interest of information sharing, that it would be a grave mistake and danger to national security for the State Department to try to define" which workers in other agencies should see the diplomatic analysis, Kennedy said. The State Department shares diplomatic information with 65 other agencies, he said.

"We provide this information to the other agency," he added. "The other agency, then, takes on the responsibility of controlling access by their people."