4 ms·

The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still

by bdamm 8y ago

The Secret Service as an organization has sophisticated cyber capabilities. That a specific agent within the president's detail didn't is less surprising. Still, I'd expect more from the organization, and I bet that the specific agents involved are getting disciplined and trained.

lvs 8y ago
Well, the head of USSS was fired today. Unclear if it's related.
- untog 8y ago
  He was also fired after the Secret Service criticised security at Mar a Lago, so we've got a few candidates to choose from in working out the real reason.
  - swamp40 8y ago
    The Secret Service reports to DHS. Mr. Alles was an ally of Ms. Nielsen, who just resigned/got the boot. Stephen Miller reportedly got the go-ahead to clean house at DHS, so all the leadership that isn't in line will get cleared out.
- sehugg 8y ago
  I'm of the opinion that a POTUS that carries a unsecured iPhone against the recommendations of his staff (and overrules their security clearance decisions for his son-in-law) isn't going to fire anyone due to quibbles over OPSEC.
  - sehugg 8y ago
    That's -3 points for a +3 opinion
  - lvs 8y ago
    Generally agree. One thing can nevertheless be used as an excuse for the others, as certain little aides carry out their certain little agendas.
- devb 8y ago
  According to the Times: >Mr. Alles was told to develop an exit plan before the arrest of a Chinese woman carrying a malware-laced device at Mar-a-Lago, exposing holes in the security of the private club. https://www.nytimes.com/2019/04/08/us/politics/randolph-alles-secret-service.html https://www.nytimes.com/2019/04/08/us/politics/randolph-alle...
llacb47 8y ago
Well, they are supposed to. "The Secret Service agent who questioned Ms. Zhang after her arrest, Samuel Ivanovich, said during testimony... [h]is four-and-a-half hour interrogation of Ms. Zhang was recorded by video... but it lacked sound because he didn’t realize that the agency’s office in Palm Beach didn’t have that capability." [0] [0] https://www.nytimes.com/2019/04/08/us/chinese-woman-mar-a-lago.html https://www.nytimes.com/2019/04/08/us/chinese-woman-mar-a-la... ¶12
closeparen 8y ago
Outside the Silicon Valley bubble, cybersecurity means Windows antivirus products, password policies, caution around unsolicited email, etc. Maybe the most sophisticated users of the term have a dim idea of what encryption means. When a government agency has "sophisticated cyber capabilities" I would generally take that to mean reams of paperwork asserting that Norton is properly installed on every desktop. The whole dimension of vulnerabilities and exploits, protocol flaws, trust boundaries, techniques for selecting or creating less vulnerable software, getting crypto implementation details right, principle of least privilege... none of that stuff even registers. I briefly worked in an IT consulting company that sold security and PCI compliance services; nobody was talking about any of that stuff. It was all password policies, antivirus products, phishing awareness campaigns. The government definitely has real computer security engineering work happening in the NSA, NIST (FIPS 140-2 in particular is no joke), and other very high end defense-related areas. But I would not generally expect people using the word "cyber" to have a fighting chance against a nation-state-level evil USB stick.

by bdamm 8y ago

lvs 8y ago

Well, the head of USSS was fired today. Unclear if it's related.

untog 8y ago
He was also fired after the Secret Service criticised security at Mar a Lago, so we've got a few candidates to choose from in working out the real reason.
- swamp40 8y ago
  The Secret Service reports to DHS. Mr. Alles was an ally of Ms. Nielsen, who just resigned/got the boot. Stephen Miller reportedly got the go-ahead to clean house at DHS, so all the leadership that isn't in line will get cleared out.
sehugg 8y ago
I'm of the opinion that a POTUS that carries a unsecured iPhone against the recommendations of his staff (and overrules their security clearance decisions for his son-in-law) isn't going to fire anyone due to quibbles over OPSEC.
- sehugg 8y ago
  That's -3 points for a +3 opinion
- lvs 8y ago
  Generally agree. One thing can nevertheless be used as an excuse for the others, as certain little aides carry out their certain little agendas.
devb 8y ago
According to the Times: >Mr. Alles was told to develop an exit plan before the arrest of a Chinese woman carrying a malware-laced device at Mar-a-Lago, exposing holes in the security of the private club. https://www.nytimes.com/2019/04/08/us/politics/randolph-alles-secret-service.html https://www.nytimes.com/2019/04/08/us/politics/randolph-alle...

llacb47 8y ago

Well, they are supposed to. "The Secret Service agent who questioned Ms. Zhang after her arrest, Samuel Ivanovich, said during testimony... [h]is four-and-a-half hour interrogation of Ms. Zhang was recorded by video... but it lacked sound because he didn’t realize that the agency’s office in Palm Beach didn’t have that capability." [0] [0] https://www.nytimes.com/2019/04/08/us/chinese-woman-mar-a-lago.html https://www.nytimes.com/2019/04/08/us/chinese-woman-mar-a-la... ¶12

closeparen 8y ago

Outside the Silicon Valley bubble, cybersecurity means Windows antivirus products, password policies, caution around unsolicited email, etc. Maybe the most sophisticated users of the term have a dim idea of what encryption means. When a government agency has "sophisticated cyber capabilities" I would generally take that to mean reams of paperwork asserting that Norton is properly installed on every desktop. The whole dimension of vulnerabilities and exploits, protocol flaws, trust boundaries, techniques for selecting or creating less vulnerable software, getting crypto implementation details right, principle of least privilege... none of that stuff even registers. I briefly worked in an IT consulting company that sold security and PCI compliance services; nobody was talking about any of that stuff. It was all password policies, antivirus products, phishing awareness campaigns. The government definitely has real computer security engineering work happening in the NSA, NIST (FIPS 140-2 in particular is no joke), and other very high end defense-related areas. But I would not generally expect people using the word "cyber" to have a fighting chance against a nation-state-level evil USB stick.