7 ms·

The TSA's response here is childish and embarrassing, although perhaps unsurprising given the TSA's institutional disinterest in actual security. It's interesti

The TSA's response here is childish and embarrassing, although perhaps unsurprising given the TSA's institutional disinterest in actual security. It's interesting to see that DHS seemingly (initially) handled the report promptly and professionally, but then failed to maintain top-level authority over the fix and disclosure process.

sweeter 2y ago
TSA is security theater, it is there to give the illusion of security. In reality it seems more like the goal is the entrenchment of surveillance and the appearance of strength.
macNchz 2y ago
What was surprising to me was that they didn't immediately do pre-dawn raids on the pentesters' homes and hold them without a lawyer under some provision of an anti-terror law.
- deleted 2y ago
  [deleted]
- garyfirestorm 2y ago
  that is apparently not a popular move anymore since people keep logs and have credentials, strong social media presence and readily available cloud enabled cameras. one email to any news org and whoever authorizes the raid will probably face some music. but knowing TSA, we can expect this any minute now...
  - tracker1 2y ago
    They just add you to a secret watch list to annoy you when you travel when you're critical of them... or the current administration, so it would seem.
  - smsm42 2y ago
    Why bother if they could just put everyone involved on the "dangerous terrorist" list which has zero controls and zero accountability because "national security"? That's what happened to Tulsi Gabbard: https://www.racket.news/p/the-worm-turns-house-senate-investigate https://www.racket.news/p/the-worm-turns-house-senate-invest...
- woodruffw 2y ago
  That's not really how this works. TSA is maliciously incompetent, but there is a reporting pipeline and procedure for these things that's formalized and designed to protect exactly this kind of good-faith reporting[1]. (It's very easy to believe the worst possible thing about every corner of our government, since every corner of our government has something bad about it. But it's a fundamental error to think that every bad thing is always present in every interaction.) [1]: https://www.cisa.gov/report https://www.cisa.gov/report
  - macNchz 2y ago
    Is there any sort of assurance that this wouldn't turn into a prosecution, though? It's not obvious to me on that site. Perhaps the CISA doesn't want to deter researchers, but do they get to make the final call? The DoJ announced in 2022 that they would not prosecute "good faith" security researchers, but it's not binding, just internal policy: https://www.scmagazine.com/analysis/doj-wont-prosecute-good-faith-security-researchers https://www.scmagazine.com/analysis/doj-wont-prosecute-good-... The policy (https://www.justice.gov/jm/jm-9-48000-computer-fraud https://www.justice.gov/jm/jm-9-48000-computer-fraud) explicitly states at the end that it's for guidance only / does not establish rights, and it includes a provision for additional consultation on cases involving terrorism or national security–terms which have both been overloaded by the government to justify overreach in the past. Personally, given the history of the CFAA, I wouldn't want to be in a position to test out this relaxed guidance on prosecuting good-faith researchers, but perhaps I'm unnecessarily averse to the idea of federal prison.
    - woodruffw 2y ago
      > Is there any sort of assurance that this wouldn't turn into a prosecution, though? It's not obvious to me on that site. Perhaps the CISA doesn't want to deter researchers, but do they get to make the final call? I don't think any sort of absolute assurance is possible, and if it was given I wouldn't trust it to be permanently binding :-) This is my intuition from having interacted with CISA, and my impression from talking to policy people: it's not 1993 (or even 2013) anymore, and there's a much better basal understanding of security researchers vs. someone trying to secure a "get out of jail free" card for doing something they shouldn't have. That doesn't mean the government can't mess up here, but I can't remember a prominent example of them throwing the book at a good faith report like this in the past decade. (Swartz is who I think of as an example of an extreme miscarriage of justice under an overly broad interpretation of the CFAA. And, of course, there could be facts in this situation that I'm not aware of that would motivate a criminal or civil CFAA investigation here. But "pre-dawn raids" aren't really it in situations like this one.)
- noinsight 2y ago
  Yeah, I don't know if I would go testing such systems and then reporting the results under my own name (presumably)... I didn't see any comment about them being contracted to do this at least.
- sixothree 2y ago
  There's still _plenty_ of time for that to happen. I wouldn't want to be this person right now. I like my dog alive.
  - extraduder_ire 2y ago
    I was thinking. They seem much more likely to react that way to public disclosure, and losing face as a result than from a professional looking private disclosure that they (either the org, or someone further up the org chart) can pretend never happened.
- deleted 2y ago
  [deleted]
garyfirestorm 2y ago
> It's interesting to see that DHS seemingly (initially) handled the report promptly... I think DHS mid level manager yelled at a TSA mid level manager who reported this to the senior TSA officials and then their usual policy kicked in... deny/deflect/ignore
- laweijfmvo 2y ago
  TSA is DHS, though. At some point, it's the same high-level manager...
wouldbecouldbe 2y ago
It’s very hard for management, even IT managers, to fully understand what such things mean. I’ve seen huge issues, like exposed keys, being treated as a small issue. While an outdated js library, or lack of ip6 support being escalated. I’m sure TSA and their partners wants to downplay potential exposure, I’m also sure it’s hard for a lot of their managers to fully understand what the vulnerability entails (most likely their developers are downplaying their responsibility and pointing fingers at others)
- jmholla 2y ago
  This is the Transportation SECURITY Agency. If the managers involved here can't understand why this is a huge deal, they're exceptionally unqualified for their jobs. Edit: Fixed a double negative (previously: This is the Transportation SECURITY Agency. If the managers involved here can't understand why this is a huge deal, they're not exceptionally unqualified for their jobs.)
  - quantified 2y ago
    Probably, they can and do understand it. They just have a deny/deflect culture.
  - doctorpangloss 2y ago
    > If the managers involved here can't understand why this is a huge deal Was it a huge deal though?
    - cortesoft 2y ago
      If this is not a huge deal, than we don’t really need the TSA at all.
      - onetokeoverthe 2y ago
        [dead]
    - ttyyzz 2y ago
ubermonkey 2y ago
[flagged]
- deleted 2y ago
  [deleted]

sweeter 2y ago

TSA is security theater, it is there to give the illusion of security. In reality it seems more like the goal is the entrenchment of surveillance and the appearance of strength.

macNchz 2y ago

What was surprising to me was that they didn't immediately do pre-dawn raids on the pentesters' homes and hold them without a lawyer under some provision of an anti-terror law.

deleted 2y ago
[deleted]
garyfirestorm 2y ago
that is apparently not a popular move anymore since people keep logs and have credentials, strong social media presence and readily available cloud enabled cameras. one email to any news org and whoever authorizes the raid will probably face some music. but knowing TSA, we can expect this any minute now...
- tracker1 2y ago
  They just add you to a secret watch list to annoy you when you travel when you're critical of them... or the current administration, so it would seem.
- smsm42 2y ago
  Why bother if they could just put everyone involved on the "dangerous terrorist" list which has zero controls and zero accountability because "national security"? That's what happened to Tulsi Gabbard: https://www.racket.news/p/the-worm-turns-house-senate-investigate https://www.racket.news/p/the-worm-turns-house-senate-invest...
woodruffw 2y ago
That's not really how this works. TSA is maliciously incompetent, but there is a reporting pipeline and procedure for these things that's formalized and designed to protect exactly this kind of good-faith reporting[1]. (It's very easy to believe the worst possible thing about every corner of our government, since every corner of our government has something bad about it. But it's a fundamental error to think that every bad thing is always present in every interaction.) [1]: https://www.cisa.gov/report https://www.cisa.gov/report
- macNchz 2y ago
  Is there any sort of assurance that this wouldn't turn into a prosecution, though? It's not obvious to me on that site. Perhaps the CISA doesn't want to deter researchers, but do they get to make the final call? The DoJ announced in 2022 that they would not prosecute "good faith" security researchers, but it's not binding, just internal policy: https://www.scmagazine.com/analysis/doj-wont-prosecute-good-faith-security-researchers https://www.scmagazine.com/analysis/doj-wont-prosecute-good-... The policy (https://www.justice.gov/jm/jm-9-48000-computer-fraud https://www.justice.gov/jm/jm-9-48000-computer-fraud) explicitly states at the end that it's for guidance only / does not establish rights, and it includes a provision for additional consultation on cases involving terrorism or national security–terms which have both been overloaded by the government to justify overreach in the past. Personally, given the history of the CFAA, I wouldn't want to be in a position to test out this relaxed guidance on prosecuting good-faith researchers, but perhaps I'm unnecessarily averse to the idea of federal prison.
  - woodruffw 2y ago
    > Is there any sort of assurance that this wouldn't turn into a prosecution, though? It's not obvious to me on that site. Perhaps the CISA doesn't want to deter researchers, but do they get to make the final call? I don't think any sort of absolute assurance is possible, and if it was given I wouldn't trust it to be permanently binding :-) This is my intuition from having interacted with CISA, and my impression from talking to policy people: it's not 1993 (or even 2013) anymore, and there's a much better basal understanding of security researchers vs. someone trying to secure a "get out of jail free" card for doing something they shouldn't have. That doesn't mean the government can't mess up here, but I can't remember a prominent example of them throwing the book at a good faith report like this in the past decade. (Swartz is who I think of as an example of an extreme miscarriage of justice under an overly broad interpretation of the CFAA. And, of course, there could be facts in this situation that I'm not aware of that would motivate a criminal or civil CFAA investigation here. But "pre-dawn raids" aren't really it in situations like this one.)
noinsight 2y ago
Yeah, I don't know if I would go testing such systems and then reporting the results under my own name (presumably)... I didn't see any comment about them being contracted to do this at least.
sixothree 2y ago
There's still _plenty_ of time for that to happen. I wouldn't want to be this person right now. I like my dog alive.
- extraduder_ire 2y ago
  I was thinking. They seem much more likely to react that way to public disclosure, and losing face as a result than from a professional looking private disclosure that they (either the org, or someone further up the org chart) can pretend never happened.
deleted 2y ago
[deleted]

garyfirestorm 2y ago

> It's interesting to see that DHS seemingly (initially) handled the report promptly... I think DHS mid level manager yelled at a TSA mid level manager who reported this to the senior TSA officials and then their usual policy kicked in... deny/deflect/ignore

laweijfmvo 2y ago
TSA is DHS, though. At some point, it's the same high-level manager...

wouldbecouldbe 2y ago

It’s very hard for management, even IT managers, to fully understand what such things mean. I’ve seen huge issues, like exposed keys, being treated as a small issue. While an outdated js library, or lack of ip6 support being escalated. I’m sure TSA and their partners wants to downplay potential exposure, I’m also sure it’s hard for a lot of their managers to fully understand what the vulnerability entails (most likely their developers are downplaying their responsibility and pointing fingers at others)

jmholla 2y ago
This is the Transportation SECURITY Agency. If the managers involved here can't understand why this is a huge deal, they're exceptionally unqualified for their jobs. Edit: Fixed a double negative (previously: This is the Transportation SECURITY Agency. If the managers involved here can't understand why this is a huge deal, they're not exceptionally unqualified for their jobs.)
- quantified 2y ago
  Probably, they can and do understand it. They just have a deny/deflect culture.
- doctorpangloss 2y ago
  > If the managers involved here can't understand why this is a huge deal Was it a huge deal though?
  - cortesoft 2y ago
    If this is not a huge deal, than we don’t really need the TSA at all.
    - onetokeoverthe 2y ago
      [dead]
  - ttyyzz 2y ago

ubermonkey 2y ago

[flagged]

deleted 2y ago
[deleted]