5 ms·

> But the U.S. military is telling its troops to stop using CDs, DVDs, thumb drives and every other form of removable media — or risk a court martial. I'm pret

by maqr 16y ago

> But the U.S. military is telling its troops to stop using CDs, DVDs, thumb drives and every other form of removable media — or risk a court martial. I'm pretty sure anyone stealing the data is already risking a court martial. If the secret files are really so wide open that they're just counting on people not being able to take them, then there's some much larger problems that they better start addressing. Also, I have a really hard time believing this one Private in the army could download hundreds of thousands of State department secret communications, then smuggle them out on CDs. Something is very broken if that's true. Either Manning is just a scapegoat, or there's massive security problems with secret information, or both.

rbranson 16y ago
I think it's pretty damning to the military that they have such huge issues with their secret data. Relatively pedestrian measures required by standards like PCI-DSS could increase the security of these systems many-fold.
- roel_v 16y ago
  I think this is understating the difficulties, and the underlying issues, the military faces. The problem comes from inherent tensions between two goals: secrecy on the one hand, efficient data dissemination on the other. You can have one or the other, but not both at the same time. So the state of the arts moves back and forth between the two.
raganwald 16y ago
I'm pretty sure anyone stealing the data is already risking a court martial. Anyone stealing the data, yes. I read the article as saying that people using remobvable media for purposes consistent with their jobs will now be subject to court martial. Example: A machine is normally connected to the network. It is moved to another location and is not connected to the network yet. Someone using a thumb drive to copy a file from a machine on the network to the unconnected machine is breaking the new directive even if the thumb drive never leaves the office or is erased immediately thereafter. Just an opinion of a paraphrasing of a leaked memo describing a directive...
- oiuytgyuio 16y ago
  After various UK government departments lost just about every USB key some new rules were introduced about how they had to be encrypted. Naturally this was hidden in a procedures manual several 1000 pages long. But because the procedure dealt with encryption of classified data - the procedures manual saying how it had to be protected was of course secret! And couldn't be issued to the workers.
- krschultz 16y ago
  Based on my experience in these kind of places, the IT procedures are a bit more robust than your average company and your scenario wouldn't really happen. And not being connected to the network would be the only reason you need removable media. If your computer is not connected to the network, it isn't very useful. Barely anything is stored locally, the risk of someone walking off with the harddrive is too high.
bbatsell 16y ago
> If the secret files are really so wide open that they're just counting on people not being able to take them, then there's some much larger problems that they better start addressing. It's a hard problem. Before 9/11, "the secret files" were locked down tightly, and every branch of the federal government that kept such files kept almost all of them separately; they were subsequently inaccessible to every other branch. The intelligence and law enforcement agencies came under harsh criticism following 9/11 — since information sharing was so limited, it was very difficult to correlate data and properly address targets and threats. The response was to pool a LOT more data than was previously available in one place on SIPRNet, which is accessible to intelligence agents, the State Department, the various military branches, federal and state law enforcement, and even some non-US allies. The truth is that the only files leaked to Wikileaks were not considered to be particularly important, had the lowest level of classification, and were accessible to (and could be easily shared by) over 3 million people. The response will unfortunately be to lock down information sharing yet again, increasing the likelihood of intelligence and response failures in the future. Most of the federal government and idiot, grandstanding congressmen made the cable leaks into a much bigger event than it would have otherwise been had they not overreacted and simply "kept calm and carried on", and the US will face the self-inflicted consequences. Secretary Gates had it right when he noted early on that, "I’ve heard the impact of these releases on our foreign policy described as a meltdown, as a game-changer, and so on. I think those descriptions are fairly significantly overwrought." http://thecaucus.blogs.nytimes.com/2010/11/30/gates-on-leaks-wiki-and-otherwise/ http://thecaucus.blogs.nytimes.com/2010/11/30/gates-on-leaks...
sausagefeet 16y ago
When I worked on Wall Street all of our Desktops literally had the USB ports ripped out. I'm really surprised the military doesn't do something like this...
- gte910h 16y ago
  I've seen them epoxyed all to hell as well.
- rorrr 16y ago
  Weren't you connected to the internet? What would stop you from connecting to Gmail (HTTPS) and emailing something to yourself?
  - die_sekte 16y ago
    Extensive proxying? MITM? There's no reason they wouldn't put their own root certificate onto the machines. For most work on Wall Street one probably doesn't even need to be connected to the internet.
    - arethuza 16y ago
      It's scary the number of people who think that HTTPS guarantees an end-to-end secure channel between your browser and the remote application.
      - die_sekte 16y ago
        Well, it does if you control the machine you're using. Or am I missing something?
        arethuza 16y ago
        AFAIK if someone else controls the machine you are on (or can get certs installed by one way or another) which can be combined with a MITM proxy to get access to the unencrypted content. However, a lot people use machines they don't control where this kind of approach is perfectly feasible.

by maqr 16y ago

rbranson 16y ago

I think it's pretty damning to the military that they have such huge issues with their secret data. Relatively pedestrian measures required by standards like PCI-DSS could increase the security of these systems many-fold.

roel_v 16y ago
I think this is understating the difficulties, and the underlying issues, the military faces. The problem comes from inherent tensions between two goals: secrecy on the one hand, efficient data dissemination on the other. You can have one or the other, but not both at the same time. So the state of the arts moves back and forth between the two.

raganwald 16y ago

I'm pretty sure anyone stealing the data is already risking a court martial. Anyone stealing the data, yes. I read the article as saying that people using remobvable media for purposes consistent with their jobs will now be subject to court martial. Example: A machine is normally connected to the network. It is moved to another location and is not connected to the network yet. Someone using a thumb drive to copy a file from a machine on the network to the unconnected machine is breaking the new directive even if the thumb drive never leaves the office or is erased immediately thereafter. Just an opinion of a paraphrasing of a leaked memo describing a directive...

oiuytgyuio 16y ago
After various UK government departments lost just about every USB key some new rules were introduced about how they had to be encrypted. Naturally this was hidden in a procedures manual several 1000 pages long. But because the procedure dealt with encryption of classified data - the procedures manual saying how it had to be protected was of course secret! And couldn't be issued to the workers.
krschultz 16y ago
Based on my experience in these kind of places, the IT procedures are a bit more robust than your average company and your scenario wouldn't really happen. And not being connected to the network would be the only reason you need removable media. If your computer is not connected to the network, it isn't very useful. Barely anything is stored locally, the risk of someone walking off with the harddrive is too high.

bbatsell 16y ago

> If the secret files are really so wide open that they're just counting on people not being able to take them, then there's some much larger problems that they better start addressing. It's a hard problem. Before 9/11, "the secret files" were locked down tightly, and every branch of the federal government that kept such files kept almost all of them separately; they were subsequently inaccessible to every other branch. The intelligence and law enforcement agencies came under harsh criticism following 9/11 — since information sharing was so limited, it was very difficult to correlate data and properly address targets and threats. The response was to pool a LOT more data than was previously available in one place on SIPRNet, which is accessible to intelligence agents, the State Department, the various military branches, federal and state law enforcement, and even some non-US allies. The truth is that the only files leaked to Wikileaks were not considered to be particularly important, had the lowest level of classification, and were accessible to (and could be easily shared by) over 3 million people. The response will unfortunately be to lock down information sharing yet again, increasing the likelihood of intelligence and response failures in the future. Most of the federal government and idiot, grandstanding congressmen made the cable leaks into a much bigger event than it would have otherwise been had they not overreacted and simply "kept calm and carried on", and the US will face the self-inflicted consequences. Secretary Gates had it right when he noted early on that, "I’ve heard the impact of these releases on our foreign policy described as a meltdown, as a game-changer, and so on. I think those descriptions are fairly significantly overwrought." http://thecaucus.blogs.nytimes.com/2010/11/30/gates-on-leaks-wiki-and-otherwise/ http://thecaucus.blogs.nytimes.com/2010/11/30/gates-on-leaks...

sausagefeet 16y ago

When I worked on Wall Street all of our Desktops literally had the USB ports ripped out. I'm really surprised the military doesn't do something like this...

gte910h 16y ago
I've seen them epoxyed all to hell as well.
rorrr 16y ago
Weren't you connected to the internet? What would stop you from connecting to Gmail (HTTPS) and emailing something to yourself?
- die_sekte 16y ago
  Extensive proxying? MITM? There's no reason they wouldn't put their own root certificate onto the machines. For most work on Wall Street one probably doesn't even need to be connected to the internet.
  - arethuza 16y ago
    It's scary the number of people who think that HTTPS guarantees an end-to-end secure channel between your browser and the remote application.
    - die_sekte 16y ago
      Well, it does if you control the machine you're using. Or am I missing something?
      - arethuza 16y ago
        AFAIK if someone else controls the machine you are on (or can get certs installed by one way or another) which can be combined with a MITM proxy to get access to the unencrypted content. However, a lot people use machines they don't control where this kind of approach is perfectly feasible.