5 ms·

Whats gov policy around Alexas and like half the IOT market? My botvac even has a microphone. I'm sure it's "don't ever speak about outside of this room" sort o

• alistairSH 3y ago
  In any SCIF or SCIF-like office space, they're all prohibited. You leave your cell phone at the front door of the secured area. Internet access is via SIPRNet (for classified) or NIPRNet (non-classified, but secured). Phones are through dedicated secure switchboards. The above is common in the DC area (lots of DoD contractors).
  • RajT88 3y ago
    My company infosec training actually advises you don't have voice assistants or cellphones in your work area. They even make light of it in the video: "I know it sounds crazy, but it's not". Google and Amazon as the biggest voice assistant makers are, of course, our competitors. But they are competitors to I would say most software companies in some fashion.
    • SnazzyJeff 3y ago
      Knowing what exploits are like in the private/state sector that seems like a no-brainer if your threat model includes a well-funded attacker.
    • ljf 3y ago
      We have been told that so many times at work, but I know most snr people seem to leave them and their smart watches in listen mode as they occasionally go off in video calls.
      • gumby 3y ago
        Once in a zoom call my watch said “sorry, I didn’t understand that”… and simultaneously the watch the other person on the call was wearing said the same thing!
  • tylerflick 3y ago
    A relative of mine used to work in this space 20 years ago. Seems policies haven’t changed at all. Tangental story about how serious the Gov takes OpSec. When I was in Iraq, a Marine in my unit found a roll of red Classified tape. He thought it would be cool to put a strip on his personal laptop, which was confiscated almost immediately. It was very clearly a personal machine, but policy is policy, and he never got that laptop back.
    • alistairSH 3y ago
      Oh yeah, they take it seriously most of the time. But you do get seemingly odd outputs from those procedures. Case in point... Many years ago, I worked part-time for a small construction cost management contractor. They did some TS work for DoD/State (usually combo projects, where NSA/CIA/Army had a wing of a consulate that State managed). I did not have a TS (or any other clearance) at the time. One day, I'm tasked with counting the windows and doors in an old hospital in Munich. All the room numbers are Sharpied out in one half of the building. So, it's pretty obvious "men in black pajamas" are using that wing. I just don't know the room numbers. Seemed super weird to me that only the numbers were considered secured info. I'm sure there was an explanation. Years later, a friend-of-a-friend was moving to Munich to do "State Department" work (he was an HVAC contractor with a TS). Off hand, I said "oh, I bet you'll be in wing X, floor Y or Z in the old hospital". He about fell over that somebody in no way associated with his agency would know that. Got a chuckle from me.
      • coolspot 3y ago
        Thank you for publishing this info, comrade! Ve arr going to chek all old Munich hospitals.
        • alistairSH 3y ago
          It may or may not be in Munich. Regardless, WikiLeaks already spilled the beans.
    • hwillis 3y ago
      > Seems policies haven’t changed at all. Yes and no. CUI was created: https://en.wikipedia.org/wiki/Controlled_Unclassified_Information https://en.wikipedia.org/wiki/Controlled_Unclassified_Inform... The number of SCIFs increased a ton, especially in contractors being allowed to have their own SCSI rooms. The number of clearances also went up a lot, and the cycle time on granting a clearance got much faster. Overall some things got relaxed, other things got stricter, scale increased everywhere. IMO the biggest factor in the increase is just the ever-increasing DoD budget
  • miki123211 3y ago
    I wouldn't be surprised if something like the Apple Vision Pro becomes common in such spaces (and for classified / company-confidential work in general) over the next few years. I think the combination of biometric authentication with a display that is immune to cameras and shoulder-surfing is really powerful. If the device has anti-screenshot protection and automatically logs the user out when removed from their head, there's virtually no way to quickly transfer sensitive documents out of it.
    • l33t7332273 3y ago
      I would be floored if that happened. SCIFs and cameras are like oil and water.
  • nox101 3y ago
    I wonder how that's going to work in our augmented future. Especially if people replace non-functional eyes and ears with digital ones.
  • chatmasta 3y ago
    How strictly are SCIF policies enforced? I'm just a civilian who's never had exposure to that world, but based on my experience with other parts of the government, I'd expect SCIF compliance to fall on a broad spectrum from "sloppy or non-existent" to "overly strict and paranoid." Is my intuition accurate? Who's accountable for the compliance of a given SCIF - can anyone with clearance "setup a SCIF" or does it need to be registered, audited, etc?
    • dwheeler 3y ago
      In my experience, they are seriously enforced, though any time you have a large number of people you'll definitely find exceptions. The threat of massive fines and long jail times tends to encourage compliance. Also, many of the people who work in SCIFs know they are dealing with information that, if released, could lead to a number of people getting killed (think intelligence sources) or a country being unable to defend itself because a US weapon system was compromised (think Ukraine). Nation-states are working to extract information from SCIFs, it's not a theoretical problem, and SCIF users know this.
    • alistairSH 3y ago
      I don't work in this space, but many of my friends do, as did my father. SCIF policies are usually strictly enforced. But, that's the most secure workplace available to civilians and they aren't all that common. They also tend to be located in facilities that are higher-than-normal security. Out here in Reston, all my friends who work in SCIFs are also in fenced/gated complexes with paramilitary guards. There are secure (but not SCIF) facilities that probably vary more. My father's little 6 person contracting office had a secure room, with a Dod approved design and a safe inside, for contracts that required that level of security (State/DoD facilities in China and Russia required TS clearance, other projects varied). The people that work in SCIFs also generally take it seriously. TS+poly is worth a big chunk of salary here in DC and not something to risk (and that's ignoring that flaunting those laws is a felony for anybody not named Trump). And most believe in the mission (whatever that happens to be). The work spans everything from military hardware to CIA or NSA operations. And a lot of stuff that probably doesn't really need to be TS, but that's a whole other discussion.
    • 3y ago
  • pastword 3y ago
    From a friend who worked in IT work at DIA c. 2000: there were an absurd, non-zero number of researchers with clearances who surfed for porn while on [SN]IPRNet, networks they knew were monitored, and unsurprisingly were caught and lost their careers. Nonzero. I'd posit the reason it continued for so long was the real reasons for termination were kept secret to avoid organizational and political embarrassment but at the expense of not setting an example. If individuals in this particular demographic are hired but lack self-control and are sexually frustrated, then they're potentially huge liabilities to being recruited by adversaries (MICE). It would seem that before issuing clearances, these factors should be assessed rather than going through a standard clipboard audit by the FBI. And, while holding clearances, positive socialization opportunities should be encouraged if not artfully arranged. Who's ever going to leave a job or be disloyal when your boss or some coworkers expedite the love lives of those who aren't already full in that regard? This implies fostering a layer of socially astute managers. It would be a radical departure for government culture perhaps, but a necessary one to ensure the integrity and stability of a clandestine community. Happiness isn't just recognition or sufficient autonomy, but total happiness beyond work. (Throw away the "work-life balance" cliche that is tired and paid lip-service to.)
    • gregw2 3y ago
      If you haven’t read the story from 2000 of CIA director John Deutch, it matches your description of that time/culture.
• deleted 3y ago
  [deleted]
• nonameiguess 3y ago
  It's actually more restrictive than the sibling makes it sound. A SCIF can't have any radio-transmitting device, recording device, or storage media without special approval. Computers hooked up to classified networks can't have USB ports. Even medical devices are case by case. My wife requires hearing aids and needed them to be analyzed and approved by a security team before she could bring them in. Pacemakers require approval. The phones and networks are hardened by being their own separate network from public networks. The lines are all buried and protected and utilize hardware-encrypted point to point tunnels to merge with public backbone fiber. I've told an anecdote here many times of working at a facility where AT&T contractors dug too close to a JWICS fiber cable and had an unmarked black SUV show up in minutes to confiscate all of their gear and question them. Keep in mind the military has been encrypting radio traffic over hostile territory for a century, so they don't even necessarily require the lines themselves to be physically secure as long as the endpoint devices are. Encryption keys are loaded from hardware random number generators that are synced manually on some rotating basis determined by local command or national policy, depending on the intended reach of the comms device. The NSA has something called a key management infrastructure for the wide-area computer net that replaced the legacy system a few years ago that is similar to PKI, but keys are only issued in-person and stored on unnetworked hardware key loaders that are kept in locked arms rooms on military installations (or with deployed units). There is, of course, also a DoD and IC PKI so they can still use develop and use regular web applications and browsers, but it is also more restrictive than regular PKI. Everything requires client certs and mutual TLS and you need to be personally sponsored to get your personal certificates. It's actually really cool the way the JWICS websites work because your client cert provides an identity that is linked to your sponsoring agency's clearance database and web apps automatically redact content on the server side that you are not cleared to see. It's possible I'm making up memories but I think I've seen at least a few cases where some applications can do this inside of a single page, but typically you get a denial for an entire application if you're not cleared for the highest level data it provides. I almost hate to say it because it's antithetical to the Internet and Hacker News ethos, but it's a testament to how well networked applications could work with a central authority and no anonymity. You don't need passwords. Accounts are provisioned automatically. SSO is global to the entire network. You only need one identity. But no, your office can't have Alexa.
• sandworm101 3y ago
  There is an entire industry for secure phones. Many have to be "unlocked" before dialing other secure phones. It isnt simple. Getting a normal phone line to passively carry an encrypted call is a bit of a hack.
  • dTal 3y ago
    A hack? The entire point of encryption is to permit messages to be sent over insecure channels, no?
    • sandworm101 3y ago
      The hack is getting the unsecure system not to damage your encrypted signal, to carry even though it is expecting plain voice talking rather than a stream of binary digits.
      • CrazyStat 3y ago
        We’ve been doing that for dialup internet for decades.
        • richardwhiuk 3y ago
          Dialup actively co-operates with the telephone system - e.g. the screeching at the start is designed to disable echo cancellers and other such mechanisms.
        • arpa 3y ago
          POTS didn't have an opus audio codec.
        • sandworm101 3y ago
          Dialup doesn't work over every phone line, especially over sat voice lines.
  • hiatus 3y ago
    > It isnt simple. Getting a normal phone line to passively carry an encrypted call is a bit of a hack. How so? It would seem fairly trivial considering we have ways of sending data over phone lines as sound for decades.