3 ms·
> Chris decided to report his discovery to the State Department and let them contact their Mexican counterparts in the spirit of cooperation. When he got no mea
by partisan 10y ago
> Chris decided to report his discovery to the State Department and let them contact their Mexican counterparts in the spirit of cooperation. When he got no meaningful response, he reached out to the State Department’s Office of Mexican Affairs, who told him they would forward his alert up the chain. When that still didn’t achieve the desired results of getting the database secured, Chris contacted the U.S. Secret Service, Department of Homeland Security, and US-CERT
I definitely am all for doing the right thing and I might make a best effort in the same situation, but that's pretty gutsy. My overdeveloped sense of paranoia would tell me that contacting these agencies would put me on all sorts of lists I wouldn't want to be on. Who knows how easy it is for "There is a data breach" could become "I have your data, meet my demands".
- arcticfox 10y agoI agree, your sense of paranoia is overdeveloped.
- astrodust 10y agoGiven how the Department of Homeland Security thinks a tiny bottle of mouthwash is a threat to national security, I wouldn't trust them to understand what a computer does.
- arcticfox 10y agoYeah, but that's theater performed by low-wage employees. I think it's extremely unlikely that sending a tip to help higher-level officials isn't going to accidentally get you on some watch list, as long as you're acting in good faith.
- astrodust 10y agoAny organization that hires these security muppets in the first place is not one I'd put any trust in whatsoever. If some awful, unfortunate thing does happen on their watch I honestly hope the first thing they do is get the hell out of the way so professionals can handle the situation.
- lelandbatey 10y ago> Yeah, but that's theater performed by low-wage employees. The status of the people who act out these policies is much less important than who is setting these policies. And it's not low-wage employees who are setting these policies, it's high level bureaucrats, the same bureaucrats who will be in charge of your fate should you report wrongdoing to them.
- riprowan 10y agoTerribly naive view. "Shoot the messenger" is the norm not the exception in a bureaucracy.
- partisan 10y ago@arcticfox How is good will determined if not through a through a thorough investigation.
- adolph 10y agoWho needs punishment when there is plenty of process to apply?
- astrodust 10y agoIt would be nice if there's a department you can trust to handle your report in a way that's both confidential and reliable about getting results. Picking up the phone and calling random departments is how you get in trouble. All it takes is one person to scream "hacker", which is not unlike yelling "fire" in a crowded building, and you've got yourself in hot water even when trying to do the right thing. If there was a number to report security issues of this sort, or an email address if they're that savvy, it would go a long way towards encouraging people to report serious issues.
- qaq 10y agoYou can relax posting this comment will put you on all sorts of lists you did not want to be on.