NASA/JPL: a small device exposed a much bigger boundary problem.
What NASA’s own audit teaches about unregistered devices, network segmentation and knowing what belongs on your LAN.
What happened?
Historical case. Incident: April 2018. Report: 18 June 2019. Source checked: 22 October 2026.
NASA’s Office of Inspector General reported that a compromised external-user account was used to steal approximately 500 MB from a major JPL mission system. The audit connected the intrusion to an unauthorized Raspberry Pi on the network.
What made it possible?
The report identified incomplete device inventory and insufficient segmentation of a shared gateway. A device that had not passed the required approval process could become an entry point into a broader environment. This was not evidence that every Raspberry Pi is inherently insecure.
How was it identified?
JPL discovered the compromised account in April 2018. The later audit examined controls, inventory and oversight through interviews and records. The report does not provide a complete public, packet-by-packet reconstruction of the initial discovery.
What was affected, and what changed?
The audit documented data theft and recommended improvements to asset visibility, access boundaries and incident handling. It is not a claim that all NASA networks were compromised or remain vulnerable today.
Primary source: NASA OIG report IG-19-022, especially the summary and inventory/segmentation findings.
Make the lesson visible on your LAN
Use your own Pi, a phone and a test web page. Place the test service on an isolated lab network and compare permitted access with a correctly configured separation rule. Keep household devices and real accounts outside the test.
A successful demonstration shows the exact connection that is allowed, the one that is denied and the inventory record explaining why the Pi belongs there. It demonstrates segmentation, not a recreation of the JPL intrusion.