11 ms·

UCOP Ordered Spyware Installed on UC Data Networks

• ausjke 11y ago
  the IT department at universities or corporations can archive all the emails "legally" in their system(not personal emails though, but emails related to job), I guess this monitoring is something live instead of a cold-storage-alike archiving? while I hate this practice, they do have the right of doing that correct?
• jph 11y ago
  I consulted for UC Berkeley on a project with the UCB IT email team. I can say firsthand they are excellent people, both technically and also morally. They are careful about security and protecting people and data. There is the usual email protection for virus scanning, spam blocking, abuse alerting, archiving of legal items, and the like. In my direct experience, the entire chain of command up to and including the UCB CTO is solid. So I hope Napolitano steps up and explains what's happening now. In the meantime if any UC Berkeley people want to learn how to use GPG for encrypting email, and VPNs for encrypting traffic, I will donate pro bono hours.
  • wfunction 11y ago
    > In the meantime if any UC Berkeley people want to learn how to use GPG for encrypting email Could you explain why this should be necessary when email communication between the servers and clients is already encrypted via SSL/TLS? Can they bypass that? (And if so how?)
    • abstractbeliefs 11y ago
      Because the operators of the servers cannot be trusted. SSL/TLS protects the data in motion, from people monitoring the networking by illegitimately MITMing users. GPG protects data at rest from server operators reading things they should not.
    • dorfsmay 11y ago
      How do you know that all your recipients' mail server aren't monitored (or webclient and the NSA pumps the data between the ssl termination and the web server, eg: google)? As a rule of thumb, if you care enough that it should not be seen by others, encrypt before it is sent, before it is written to disk. You have no control over a stolen laptop, over what the backup servers (assuming remote backup), etc... If it is private, encrypt. There's a bit of a learning curve, but once you do it often enough it just becomes part of the workflow. Good tools you should use on a regular basis: KeepassX, gpg, Enigmail
      • wfunction 11y ago
        That's always true though and it has nothing to do with this situation in particular.
        • dorfsmay 11y ago
          > it has nothing to do with this situation in particular. Please read the parent's question, asking why it would be necessary to encrypt when using SSL/TLS. I explain why, and yes I do go a little bit further to more general cases, because I am assuming that if they don't understand the need to encrypt in this specific case they could benefit, and hopefully appreciate, to understand the more general cases as well.
    • deleted 11y ago
      [deleted]
    • pdkl95 11y ago
      > servers You're trusting the server too much. While TLS servers an important role, it is only protecting the link, not he data. End-to-end encryption (which PGP/GPG provides) is important for the same reason bittorrent is so successful: it protects the data, not the host. When bittorrent was new, a common concern was that you might be getting the data form anybody, including people who are malicious. This concern was a product of traditional download methods where you had to trust the person sending the data ("only download from reputable sources"). Bittorrent bypassed that problem by providing hashes, so the data itself could be verified regardless of how you got it. Securing of a host or connection suffers from the same problem. Just like how reputable fileservers can still be hacked or strong-armed into serving incorrect data, the server at the end of the TLS connection can be compromised. > how That depends on the people at the TLS endpoints who see the plaintext. If they are collaborators, they simply build in access to the plaintext and we call it "Prism". If they are refuseniks, it might be necessary use a national security letter.
      • prdonahue 11y ago
        Not to mention the fact that they're probably installing their own root certs on the endpoints and then just MITM'ing everything with their own certs.
    • zrm 11y ago
      > Could you explain why this should be necessary when email communication between the servers and clients is already encrypted via SSL/TLS? Can they bypass that? (And if so how?) RFC2487 Section 5: A publicly-referenced SMTP server MUST NOT require use of the STARTTLS extension in order to deliver mail locally. This rule prevents the STARTTLS extension from damaging the interoperability of the Internet's SMTP infrastructure. A publicly-referenced SMTP server is an SMTP server which runs on port 25 of an Internet host listed in the MX record (or A record if an MX record is not present) for the domain name on the right hand side of an Internet mail address. In other words, internet mail servers are required to allow a trivial downgrade to plaintext by a MITM attacker.
      • btgeekboy 11y ago
        And if you don't follow the RFC, the internet police will come after you! Yes, I am aware of the RFC2119 meaning of "MUST NOT." In reality, nothing prevents the servers from disallowing that downgrade, except that they may not be interoperable with other servers on the internet. If the operator of the server wishes to make that tradeoff, then requiring STARTTLS is an option.
        • zrm 11y ago
          If you don't follow the RFC then people will email you from gmail saying "I tried to send you mail from my company's mail server and it didn't work", other people will submit a github issue to your project saying they couldn't email you, and when you try to subscribe to one of djb's mailing lists you'll get a response from your mail server saying it couldn't deliver the message. That is what actually happened when I tried it.
          • spc476 11y ago
            And I subscribed to a mailing list years ago that suddenly went TLS-mandatory (for incoming email---it doesn't demand TLS when sending email) and now I can't even unsubscribe from the list.
      • LinuxBender 11y ago
    • throwaway72727 11y ago
      I think this point has been made in some way or another in the thread, but I want to try to restate it. Suppose Alice (alice@gmail.com) emails Bob (bob@yahoo.com). If Alice sends Bob an email without PGP encryption, the text of those emails is stored on both Google's and Yahoo's servers, allowing either of those companies to read the email (or a government if served with a subpoena, or others -- possibly the general public -- in the event of a data breach). This is true regardless of whether it was sent with TLS at every point in the chain. On the other hand, if Alice uses PGP to actually encrypt the text of the email with Bob's and her public key, nobody except Alice and Bob themselves (not even Yahoo or Google, who have the message stored on their servers) can read the message. It's an important distinction -- as major consumer messaging products like Apple's iMessage, WhatsApp, etc. have recently started to implement this end-to-end encryption where even the company themselves are unable to read the message their users are sending, the FBI and other federal agencies have started to actually complain about their newly limited ability to spy, unlike when only TLS was used and they could just serve an NSL to Apple/Google/etc. to make them give up your message without your knowledge (with their only other option being shutting down their business, more or less).
  • garraeth 11y ago
    That's wonderful you are willing to help everybody (seriously). But, I think people need to be aware that it's not just email: "The intrusive device is capable of capturing and analyzing all network traffic to and from the Berkeley campus, and has enough local storage to save over 30 days of all this data ("full packet capture"). This can be presumed to include your email, all the websites you visit, all the data you receive from off campus or data you send off campus." Is there anything we can do to protect ourselves from, say, posting something into a HN forum? Or any chat program? Or FB chat, etc...?
    • jsprogrammer 11y ago
      >Is there anything we can do to protect ourselves from, say, posting something into a HN forum? Or any chat program? Or FB chat, etc...? TLS or other encryption. However, if they [UCOP, vendor, other] get your key(s) they will be able to read archived traffic.
      • nsgi 11y ago
        Not with Perfect Forward Secrecy
        • jsprogrammer 11y ago
          PFS just adds additional keys.
          • mehrdada 11y ago
            Keys that are supposedly short-lived on the client and the server. And if you are assuming they already control the client or the server endpoint, then the entire discussion is moot, but considering we are talking about archived packets at a router interface, the parent comment is very valid.
            • jsprogrammer 11y ago
              It is certainly valid, but is also covered by my original case. I just wanted to be explicit about the connection between the posts.
  • tehwebguy 11y ago
    > So I hope Napolitano steps up and explains what's happening now. Not likely, she is the former head of the Homeland Security Department
  • trhway 11y ago
    >So I hope Napolitano steps up and explains what's happening now. given Napolitano's pedigree, in AZ and DHS, i think the best explanation you can expect, if any, that it is either to protect children and/or national security without any details. Btw, how she could end up as the head of UC?. Her record is like a mini-Bush in action. You can't make it up https://en.wikipedia.org/wiki/Janet_Napolitano#Walmart.E2.80.93DHS_partnership https://en.wikipedia.org/wiki/Janet_Napolitano#Walmart.E2.80... Do you seriously think that choosing between new spectrometer and network snooping device she would choose spectrometer over her DHS security contractors? I can only suppose that the UC search committee somehow ended up with only Hoover and Napolitano on the short list, and as Hoover hadn't returned multiple phone calls...
    • jacobolus 11y ago
      “Mini-Bush in action” is a ridiculous summary of Napolitano’s career. Both Democratic Governor of AZ and Secretary of Homeland Security are quite politically constrained positions in US politics. Arizona is a state with a radical Republican majority in both houses of the state legislature which has been in control for decades. There’s really only so much a Democrat can do as governor. I personally think the structure and many of the activities of the DHS are ridiculous, but that’s the fault of Congress, not of the person appointed to be its executive. Napolitano seems to me like a competent mainstream (“centrist Democrat”) politician, not unlike most of the people who would be considered for a post like UC President. She’s not my personal favorite, and I disagree with her about many policy topics, but in a lineup of US ex-governors, she’s easily in the top quarter. By contrast, Bush was an absolute disaster in every way.
    • toomanybeersies 11y ago
      > This is a video message from Napolitano on TV screens in Wal-Mart stores playing a "public service announcement" to ask customers to report suspicious activity to a Wal-Mart manager. The rationale is that national security begins at home. Napolitano "compares the undertaking to the Cold War fight against communists." Generally, the communist witch hunts of the 50's, 60's and 70's (especially the House Un-American Activities Committee) aren't considered a good thing. Apparently now they are.
  • gregniemeyer 11y ago
    Thanks it would be great to have a recipe for how to maintain privacy here at UC Berkeley, and also a recipe for how to ensure that the information we want to share can be shared.
• ch 11y ago
  Hopefully this forces all UCB faculty to begin to use GPG for all email communication; then that in turn requires all the faculty contacts to use GPG; finally the GPG virus spreads nationwide due to this one selfish act!
  • dd9990 11y ago
    GPG and HTTPS are just band aids over a far more serious problem. They don't protect meta data. Knowing what sites you connect to and who you email and how often is more than enough to seriously undermine privacy and chill discourse. The real solution is a political one, not a technical one.
    • rms_returns 11y ago
      > Knowing what sites you connect to and who you email and how often is more than enough to seriously undermine privacy and chill discourse. Two band-aids are available for circumventing that too. They are called "VPN routing" and "Tor".
    • Spooky23 11y ago
      That is not at all germane to this issue -- we're talking about a campus mail system, so all metadata is inherently available to the system.
      • eru 11y ago
        They intercept people using SMTP to connect to non-campus email systems, too.
    • cheezburgler 11y ago
      Who you e-mail is protected by TLS
      • jvoorhis 11y ago
        Up to the point that your SMTP session is decrypted. It TLS is terminated by your campus's middlebox, it is in their purview.
• zbjornson 11y ago
  I was similarly unsurprised to find out that Stanford monitors all emails, including ones not sent via Stanford servers. I noticed my emails sent via SMTP to an outside server (edit: while connected to campus network) were getting softfail header flags because they were being relayed by Stanford. I'm sure all network traffic is monitored as well -- the network usage policy explicitly allows them to.
  • richardwhiuk 11y ago
    >> I noticed my emails sent via SMTP to an outside server were getting softfail header flags because they were being relayed by Stanford. This doesn't make any sense - either you were sending them via Stanford or you weren't. If you weren't, how can they be relayed via Stanford?
    • r0muald 11y ago
      He could have been sending them to a third party SMTP server from inside the Stanford network.
    • hackbinary 11y ago
      Because Stanford has a silent proxy picking up SMTP traffic, and running it through their security system. http://serverfault.com/questions/382329/routing-smtp-and-pop3-past-iptables-through-proxy http://serverfault.com/questions/382329/routing-smtp-and-pop...
    • pcl 11y ago
      Presumably zbjornson was sending messages from a network within Stanford, using vanilla SMTP. In that sort of topology, Stanford's network could easily intercept, monitor and modify SMTP traffic.
    • zbjornson 11y ago
      What the posters below said. If you use SMTP to send to an external server, and you are on Stanford's network, they intercept it. "Relay" might have been the wrong word.
  • 11y ago
• gradys 11y ago
  How surprising is this when Janet Napolitano[1], former Secretary of Homeland Security, is the president of the UC system? [1] - https://en.wikipedia.org/wiki/Janet_Napolitano https://en.wikipedia.org/wiki/Janet_Napolitano
  • beachstartup 11y ago
    yeah, wow. as a uc alum this is definitely a surprise, and kind of disappointing.
  • ajmurmann 11y ago
    I honestly had no idea she was running the UC system now. I'm actually shocked to see her in that position. That only furthers my disillusion with anything related to politics.
    • huac 11y ago
      Condi Rice was the provost of Stanford and is now on the Dropbox board. Norcal has a surprising affinity for neocons...
      • wavefunction 11y ago
        Let's not forget John Yoo, the lawyer for the Bush Administration who kindly wrote the legal memorandum providing justification for an official adoption of torture, who was hired on at Berkeley law. Not only did these criminals never pay for their crimes against humanity, they've been allowed to prosper. It's a shame.
      • jlmorton 11y ago
        Janet Napolitano is a liberal Democrat, former governor of Arizona, and the Secretary of Homeland Security under Barack Obama. How does this make her a neocon?
        • huac 11y ago
          I mean in terms of foreign policy (keep USA an unchallenged number 1 militarily and economically) and willingness to use surveillance as a mechanism of control. I get your point that socially or whatever she's not a neocon, but we're not talking about views on abortion, etc. in this thread. Do you have a better word than neocon? > Janet Napolitano [was] the Secretary of Homeland Security under Barack Obama. That qualifies her w.r.t. surveillance and exercise of power. Sounds a lot like her approach to the UC system! Barack Obama, while a Democrat, commands a fleet of extrajudicial killing machines that have been used to murder American citizens without trial. It was during Napolitano's time at DHS that drones for surveillance and control (read: killing) became cemented as governmental policy. Elsewhere here commenters mentioned John Yoo and Condi Rice for their roles in enabling W's torture policy. How is Napolitano's support for drones (and many other things - http://www.foxnews.com/opinion/2013/07/17/janet-napolitanos-orwellian-legacy.html http://www.foxnews.com/opinion/2013/07/17/janet-napolitanos-...) different?
• pg_is_a_butt 11y ago
  so quit your job there, or drop out or don't enroll. real simple solutions, you cowards.
• jlgaddis 11y ago
  Pretty much every .edu with more than a few thousand students is likely already doing this. If you work at one of them, you should not be surprised to know that your traffic is being monitored or that the capability is there. Is the "uproar" because of the capturing itself or because the captures are being sent to/monitored by an external third-party?
  • deleted 11y ago
    [deleted]
  • deleted 11y ago
    [deleted]
  • free2rhyme214 11y ago
    Ditto. I don't find this surprising either. If you work for someone else, they can do whatever they want with your communications on their devices. I don't work at Berkeley but my guess is their system can do more than record emails which is extremely pervasive.
    • privong 11y ago
      > If you work for someone else, they can do whatever they want with your communications on their devices. I agree with regard to companies, but I think it's a bit less clear for a university in general. Yes, the faculty and staff are clearly employees and so in a that sense it's reasonable to expect their internet usage will be monitored. But on the flip side, one of the historical aspects of universities is supposedly intellectual freedom. And in the sense that faculty might feel a chilling effect on their intellectual freedom if they know or suspect everything this type of monitoring, monitoring might be less acceptable. When it comes to students, this argument is perhaps less clear. The students are not employees. Yes it's true they have all clicked "I Agree" to the university's network terms of service (but with all TOS's, how many of them actually read it?). But again, universities are ostensibly havens for intellectual freedom; what would pervasive monitoring do to that? So, I think you are technically and legally correct, but I wonder if that justification is in the long-term best interests of universities as institutions of learning and exploration.
• at-fates-hands 11y ago
  This is actually pretty funny. In the first email, which basically is loaded with innuendo and short on actual facts it states: UCOP defends their actions by relying on secret legal determinations and painting lurid pictures of "advanced persistent threat actors" from which we must be kept safe. They further promise not to invade our privacy unnecessarily, while the same time implementing systems designed to do exactly that. Then in the nest email says: A network security breach was discovered at the UCLA Medical Center around June 2015. UCOP began monitoring of campus in networks around August 2015. ONLY AFTER this monitoring, on August 27, 2015, did UCOP issue a new cybersecurity policy online under the heading of "Coordinated Monitoring Threat Response." The policy describes how UCOP would initiate "Coordinated Monitoring" of campus networks even though it is believed that such monitoring was already underway prior to the announcement of the new policy. So first they were drumming up conspiracy theories about "supposed" threats to the network and in the second email, they outline there actually was a breach of their network. I guess the real issue is they have no idea who the vendor is and what exactly they're doing with their data. The good news is appears they're only holding up to 30 days of data, but aren't clear what happens after the 30 days. I would be more concerned about the lack of transparency with what they intend to do with the data and who the hell the vendor actually is. Nothing like having some shadowy government vendor snooping around your network and storing and analyzing your data without letting you know what they're doing.
• xndjcjdjf 11y ago
  Just because something isn't surprising doesn't mean it's right.
• stochastician 11y ago
  I left industry to be a postdoc in the AMPLab and it's really depressing to see this sort of intrusive monitoring coming to the home of BSD and sockets. One of the benefits of working in academia in CS has been the absence of top-down corporate IT control -- no MDM on you mobile devices, no third-parties having root on your devices, the ability to have a static IP, etc.
  • swiley 11y ago
    The university I go to requires giving root access to third party closed source apps to use most of their IT infrastructure. I don't do this of course so I end up having to use things as a "guest" and occasionally my email clients can't sync.
    • stochastician 11y ago
      Where do you go?
    • joeyo 11y ago
      BigFix? It would be bad enough if you were, say, provided a laptop to use for work, but I'm guessing they want you to install that on your personal machines too, no? Unconscionable.
    • eru 11y ago
      Could you give them root access in a VM?
      • swiley 11y ago
        That's a good idea for my laptop.
      • deleted 11y ago
        [deleted]
  • KKKKkkkk1 11y ago
    I'm curious what led you to leave industry for a postdoc. AMPLab is a great place with lots of smart people, but I'm guessing you've taken a > 4x pay cut with dim chances for career development, unless you're shooting for a faculty position.
• mintplant 11y ago
  The article is a little unclear - is this going on at other UC campuses besides Berkeley?
  • mintplant 11y ago
    Answering my own question: yes. > On Dec. 7, 2015, several UC Berkeley faculty heard that UCOP had hired an outside vendor to operate network monitoring equipment at all campuses beginning as early as August 2015.
• jbssm 11y ago
  I wouldn't be surprised if they would claim they are doing this to stop harassment to the female staff and everybody just accepts it. Combating female harassment in the academia is now the acceptable excuse for anything just like pedophilly or terrorism is for the general public.
  • evgen 11y ago
    I think there is a #mensrights or #gamergate group you need to get back to. kthxbye.
  • ethanbond 11y ago
    How is this at all relevant? Go troll someplace else.
    • dang 11y ago
      If you think someone is trolling, please don't make the thread worse by feeding it. Instead, flag the comment by clicking its timestamp to go to its page, then clicking 'flag'. An account needs a small amount of karma (currently 31) before flag links appear.
    • jbssm 11y ago
      Do you know the reason they did it? Then yes, it's relevant, since it's very well a possible explanation.
  • dang 11y ago
    Please stop posting ideological rants to Hacker News.
• greggarious 11y ago
  Does this include data sent by students in the course of their classes? If so, couldn't this be a FERPA violation?
  • stevenbedrick 11y ago
    I don't know precisely, but if FERPA works the way HIPAA does, there's a carve-out for arrangements like this provided that the vendor has an agreement in place (a BAA in HIPAA-speak) and agrees to abide by certain security standards. Note that, in practice, it goes like this: VENDOR: We promise that we are doing all of the stuff that the law says we're supposed to do to protect the covered data that you're sending us. Look, see the pretty pictures of a fancy data center in our marketing materials? CUSTOMER: OK, that's good enough for us! (checks off box on list)
• huac 11y ago
  My school uses Google Apps for email (among other stuff). Does anybody know if that setup can be/is monitored?
  • jvoorhis 11y ago
    Absolutely. Google's Apps for Work line includes the Vault product, which can be used for compliance, monitoring and e-discovery.
    • huac 11y ago
      Looking more into this: if your Google Apps for Work/Education account has unlimited storage, then your company has definitely purchased Vault as well. Easily checked in Gmail.
      • aselzer 11y ago
        https://apps.google.com/products/vault/ https://apps.google.com/products/vault/ Thanks, for me it is: Don't use Google Apps for Education for anything except for taking advantage of it by uploading your encrypted data to the nice "unlimited" Google drive space or sending PGP mails.
        • sillysaurus3 11y ago
          Don't use Google Apps for Education for anything except for taking advantage of it by uploading your encrypted data to the nice "unlimited" Google drive space Is this really abusable in this fashion?
          • mehrdada 11y ago
            I have a few terabytes of encrypted backups and disk images (via command line OpenSSL) on my "unlimited" Google Drive for Education account. I do not consider this an abuse, but a perfectly valid use case for Google Drive. If they don't like it, they can feel free to stop using the word "unlimited". However, I believe they do do some sort of throttling.
• tilt_error 11y ago
  By definition; any democratic society has the government it deserves. If not, the society is not a democracy or the citizens are idiots. The etymology of "idiot": from "idiota" (Late Latin) an "uneducated or ignorant person", and from "idiotes" (Greek) a "layman, person lacking professional skill". Now, vote wisely.
• codeonfire 11y ago
  In the workplace it's useful to follow counterintelligence strategies. Send yourself outlandish job offers from spoofed addresses, for example. The possibilities are endless.
  • gnu8 11y ago
    Looks like an opportunity to launch a $10/mo subscription service.
    • a3n 11y ago
      If you had linked to an existing service, I would have signed up on impulse.
      • jeffbr13 11y ago
        No need! A LinkedIn account with a recruiter-visible email address will result in these sorts of unsolicited emails with no subscription fees at all.
• dpweb 11y ago
  Can someone better explain the privacy outrage? - These are University resources? - Any corporation you work for would be monitoring their email systems and letting users know that. Why are these Univ. resources owned by the people? - There's many legitimate reasons for monitoring. Security, legal defense, etc.. I'll admit trying to sneak this through over objections was probably not handled in the best way from a PR perspective. And if you're privacy minded you should already know - most privacy debates that make the news - are moot. If you have something truly secret - you must encrypt - so no man in the middle can read. If you think you have privacy sending any unencrypted email over any public network you're dreaming. Assume that anyone with the key - has your data. Ask the guys that lost millions with Mt. Gox.
  • maxerickson 11y ago
    The emails focus a little bit on the system not letting users know. Also, I imagine some of the faculty would have concerns beyond their personal privacy; things like academic freedom.
  • rhizome 11y ago
    If you enlist Mt. Gox to rationalize this as, "huh, what do you expect when you use the word 'privacy?', I'm not sure that's a strong position. And if you're privacy minded you should already know - most privacy debates that make the news - are moot. Mooted by what? The fragility of privacy itself?
  • jsprogrammer 11y ago
    >Why are these Univ. resources owned by the people? Why wouldn't these Univ. resources be owned by the people? Check the title of UniversityOfCalifornia.edu: >University of California | The only world-class public research university for, by and of California. The University is established by the California constitution. Article 9. Section. 9. (a) The University of California shall constitute a public trust, to be administered by the existing corporation known as "The Regents of the University of California," with full powers of organization and government, subject only to such legislative control as may be necessary to insure the security of its funds and compliance with the terms of the endowments of the university and such competitive bidding procedures as may be made applicable to the university by statute for the letting of construction contracts, sales of real property, and purchasing of materials, goods, and services.
• mschuster91 11y ago
  Money quote: > - The intrusive device is capable of capturing and analyzing all network traffic to and from the Berkeley campus, and has enough local storage to save over 30 days of all this data ("full packet capture"). This can be presumed to include your email, all the websites you visit, all the data you receive from off campus or data you send off campus. Just how expensive was that system?!
  • ethbro 11y ago
    > Just how expensive was that system?! Attorney-client privilege.
• ck2 11y ago
  Would anyone know in the USA if there was a "30 day full packet capture" system on every ISP ? https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter No judicial review. At all.
  • andyzweb 11y ago
    pro tip: there already is a full packet capture system on every ISP
• geggam 11y ago
  Why is anyone familiar with email surprised that other people can read it ? Remember when people called email internet postcards ?
• themartorana 11y ago
  I'm a bit shocked that I need to be surveilled by absolutely everybody. It's bad enough my government does it, but at least the conversation starts with the fact that they're spies by profession. Now my college needs to surveil my online activities? I'm not the president of a major university, but how is this justified in the least?
  • a3n 11y ago
    UC exists by the good graces of the State of California. In some sense, UC is the government, same as the DMV. https://en.wikipedia.org/wiki/University_of_California#Governance https://en.wikipedia.org/wiki/University_of_California#Gover...
    • djcapelis 11y ago
      > UC exists by the good graces of the State of California. In some sense, UC is the government, same as the DMV You've actually dramatically understated it, I think. The UC doesn't exist through the good graces of the state. The UC's good graces are sufficient to make them exist under the state constitution absent any other part of government. If the legislature or governor wanted to shut them down, the only way they could do it is if they could get enough other regents to vote for it. The UC system has a great deal more power than the DMV. For one, the legislature is explicitly not allowed to regulate them outside a few ways involving funding. Also, the UC has its own state level police agency, that is controlled by UC, not any other part of the state government. The DMV is involved in some of the things CHP does, but CHP doesn't report to the DMV. UCPD reports to UC. UC governance is pretty fuckin' wild.
  • deleted 11y ago
    [deleted]
• chinathrow 11y ago
  As if that could shine more light into why the network breach occurred...
• fencepost 11y ago
  Seems to me that a big part of the concern is that this is imposed by and reports to the UCOP (University of California Office of the President?) and is independent of all local IT staff beyond "stick this black box between your network and the world and don't tell anyone about it." Covert action does not inspire trust.
• jonesb6 11y ago
  Absolute power corrupts absolutely. If NSA contractors were brazen enough to look up the private information of spouses and "ex-lovers" [1] I don't see why the IT departments of education systems won't evolve to be susceptible to the same thing. "Oh hey look, snapchat traffic!" [1]: http://www.reuters.com/article/us-usa-surveillance-watchdog-idUSBRE98Q14G20130927 http://www.reuters.com/article/us-usa-surveillance-watchdog-...
  • toufka 11y ago
    Or, you know, have access to one of the world's premiere research institution's data in real-time. The amount of NDA'd traffic alone across UC's network is enormously valuable. How many private companies made of valuable, transmittable IP have have endpoints within that network?
• deleted 11y ago
  [deleted]
• anomic_one 11y ago
  Hardware: Fidelis XPS. 40U in the campus data center, unusual power and cooling requirements, sending a lot of data to Oakland and the vendor.
  • toufka 11y ago
    From their product page: [1] Deep Session Inspection®. Decode and analyze content in real-time, no matter how deeply embedded it is. The Deep Session Inspection engine sees every single packet that traverses the network, reassembles those packets into session buffers in RAM, and recursively decodes and analyzes the protocols, applications and content objects in those session buffers in real-time - while the sessions are occurring. This allows XPS to “see deeper” into applications and, in particular, the content that’s flowing over the network. Detect and Investigate Retrospectively. Investigate what attackers have done in the past. By collecting and storing rich content-level metadata from both the network and the endpoint, XPS provides a lighter, faster and less expensive way to analyze historical data. [1] https://www.fidelissecurity.com/products/fidelis-xps https://www.fidelissecurity.com/products/fidelis-xps
    • mentat 11y ago
      Time to do some fuzzing experiments...
• Zigurd 11y ago
  Is there any background to what seems like assertions made in the article? Who did the installation, and how were they coerced into secrecy? The article says information is sent directly to the vendor? Who is the vendor? The article mentions "attorney-client privilege." Which counsel? Do they work for the state? UC CIO Tom Andiola is said to have promised that the monitoring equipment would be removed and disclosed. Then other UC senior management retracted that promise. Has anyone followed up with Tom Andiola? Hasn't he got a system-wide trust problem now? How is he taking being hung out to dry this way? And, on top of all that, how does a UC president hire a contractor in secret? How is that legal? And how do you think it happened? Was Janet Napolitano really that concerned "for the children," or was this a sweetheart deal with the seeds sown back at DHS?
• toufka 11y ago
  Have the actual letters between the JCIT and the UCOP been released to the public?
• jtth 11y ago
  Wait so port mirroring is now a reason for outcry?
• zifnab06 11y ago
  Any ideas what all they're logging? Netflow wouldn't surprise me, but that is just traffic metadata.
• jcrawfordor 11y ago
  So, I don't want to defend UC entirely, because they appear to have seriously mishandled this in several ways. But I would like to share some information about this aspect of security. Full packet captures of network traffic are extremely, extremely valuable in post-compromise incident investigation and in incident detection, as they allow for vastly more complex analysis of traffic (done post-hoc with more complicated logic) than is practical on the wire. There's absolutely no need to invoke the NSA here: multiple private vendors offer these systems. It sounds like UC went with Fidelis, another major provider is RSA NetWitness (now part of EMC). These systems are fairly common on corporate networks, the main thing that limits their installation is cost: just the storage becomes rather costly at large scales. Invoking attorney-client privilege on matters related to security is pretty common in the private world. The reason for this is that any security investigations and reports are subject to legal discovery and may be used to establish liability in the event that someone sues you for a matter related to a cybersecurity incident. The primary way to protect this information is to place the cybersecurity function under legal counsel so that all security work is work-product of an attorney and so under privilege. This is a recommended best practice in the security compliance community. Public institutions do this less frequently for the reason that it is often prevented or superseded by the relevant public record/accountability law, or unnecessary due to some type of immunity for example, but this may not be the case in California. All in all, nothing here strikes me as particularly unusual practice for a large organization. What I do see is that UC has made several massive mistakes in implementation: 1. It must be completely clear to users that they have no expectation of privacy when using organizational networks. Unfortunately, many users do not realize this, and many organizations do not sufficiently communicate it. All users of organizational networks should sign an agreement to ensure that they are aware that they have no expectation of privacy. This is already legally true in as far as I know all cases, but there is an ethical obligation, I think, to ensure further than that. 2. Universities present a particularly tricky situation because there is a captive audience of users who rely on the university network for their personal usage. Ideally this should be 100% segregated from the institutional network, I believe, but I have work experience in a small university's IT and I can tell you how difficult this is to manage - and I can imagine that the problems at the scale of even a single UC campus are so much greater. They can and definitely should work harder to balance network management against the privacy of their captive users. 3. It appears that there are inadequate controls in place (or at least disclosed) to protect this data. I am very uncomfortable with the involvement of a third-party without thorough documentation of their controls in place and their liability in the event of misuse. There must also be further internal controls - both technical and administrative - to guard against misuses. Simply asserting that the data is only used for security is not sufficient, set actual controls to ensure this and establish how violations will be handled. 4. Creating fragmentation within the IT org is very common in universities but still a terrible idea. All levels of IT and security operations should be 100% on board with security mechanisms used, which appears to not be the case here. A couple of auxiliary thoughts: - If they are intercepting SSL (which may be a good idea for a corporate network, there are several factors to weigh against each other) this will of course be limited to computers that they manage. - Tivoli BigFix, as mentioned elsewhere, is a common and rather good endpoint security solution. A similar competitor is Cisco NAC. These aren't scary NSA codewords, they're commercial products that many corporations use to ensure that all computers on a protected network meet a minimum security configuration. Whether or not they are appropriate in the ways that some universities use them is a very touchy issue, I don't think that they are, but that means that potentially much more costly (and inconvenient) controls will need to be in place. - Universities need to carefully manage the fact that they are often not perceived as corporate orgs in terms of their network practices, although they usually behave like them. There are certainly complications at universities. Open communication of policies and procedures will help to alleviate this, as well as good network management (once again, complete isolation of residential and administrative networks should be the goal).
• whitehat2k9 11y ago
  Well, that's what happens when you put the former head of Homeland Security in charge of a university.
• tbhelsson 11y ago
  There are many campuses at UC and each has it's own IT department, under that campus's governance. Berkeley's IT is very strong, as it said in the article, and reports up through that campus. As it also said, UCOP circumvented that policy framework by installing the box, then declaring that action was in their purview. UCOP administration is not the same as Berkeley admin. So who gets to do what is now in the hands of UCB faculty (but privacy/security is definitely a societal issue and needs everyone's attention.)
• gregniemeyer 11y ago
  We are hosting a forum at UC Berkeley on this issue tomorrow Tuesday from 3-5 PM at 630 Sutardja Dai Hall. We are most concerned about DNS logs.
• dekhn 11y ago
  I used to work for Berkeley Lab, which is run by UC, on a network research group in the mid-2000s. Already by that time, Berkeley Lab, and the UCs were passing their traffic via passive fiber optic tap to a deep packet inspector developed by my team. It was called Bro (https://www.bro.org/ https://www.bro.org/). It didn't have the disk capacity to save 30 days of traffic (at Berkeley's level of traffic, that's quite a lot of storage) but it certainly did some pretty deep snooping. It was used primarily for security (it would log into the router and cut off connections that appeared to be hackers). I got a call from IT one day asking what I was torrenting (it was a linux distro).