10 ms·
Army National Guard announces data breach
- valgaze 11y ago"All current and former Army National Guard members since 2004 could be affected by this breach because files containing personal information was inadvertently transferred to a non-DoD-accredited data center by a contract employee [...]"
- deleted 11y ago[deleted]
- MangoDiesel 11y agoI may be overly cynical of US government policies and procedures, but I read this as someone tried to use AWS or similar without permission.
- readme 11y agoThat's not cynical at all, and the reason why Amazon is currently working on building DoD approved data centers (Not sure if it was in mainstream news... I saw it when I was browsing job listings)
- fixermark 11y agoI'm reminded of the breach reported by Britain's National Health Service in 2014 (http://www.theguardian.com/society/2014/mar/03/nhs-england-patient-data-google-servers http://www.theguardian.com/society/2014/mar/03/nhs-england-p...), where data was uploaded to make use of Google's big-data sifting technologies in violation of NHS policy about secured storage of British citizenry PII. The irony that the data had been uploaded to a physically secured, encrypted datacenter network from 27 DVDs in the possession of someone who could do whatever they wanted to with the contents of those DVDs without audit was not lost on me. I don't reference this to imply it was good and proper use of the data; merely to note the difference between policy security and actual security.
- sp332 11y agoWow, excellent response. It's encouraging to see that they don't just sweep this under the rug.
- click170 11y agoIts good that they own up to it but I'm getting a bit tired of hearing "we take security very seriously." I feel like this phrase has become the mating call of organizations who aren't serious about security until they get hacked.
- benihana 11y agoGreat response from jedberg about the business costs of security and the fact that a company can take it seriously and still have a breach: https://news.ycombinator.com/item?id=9834461 https://news.ycombinator.com/item?id=9834461
- Encosia 11y agoObligatory: http://www.troyhunt.com/2015/07/we-take-security-seriously-otherwise.html http://www.troyhunt.com/2015/07/we-take-security-seriously-o...
- shredprez 11y agoWas just about to comment. Ever since I read the article, it's the first thing I notice (whether or not that's fair).
- pekk 11y agoDoes it follow that if an organization discloses a security issue, it wasn't serious about security?
- fixermark 11y agoI'd call this an exception. An organization that is willing to take one on the chin, so to speak, by declaring a breach of their policies even in the absence of evidence of abuse of the policy violation is actively demonstrating their commitment to security before they've been hacked.
- x5n1 11y agoIt is better to simply assume that all data has been breached unless incontrovertible proof is found to the contrary.
- shortstuffsushi 11y agoSeems kind of like the "law of security testing" -- the lack of evidence of data breaches doesn't preclude the possibility of leaked data.
- shawndumas 11y agothe absence of evidence is not evidence of absence. http://youtu.be/MFBjCM0mZHg http://youtu.be/MFBjCM0mZHg
- innguest 11y agoThat advice is good for logicians, not consultants. Clearly it is better from a consultancy point of view to assume all data has been breached and everything that could break is broken and needs fixing.
- thaumasiotes 11y agoAs spacehome points out, that advice is a logical contradiction (and therefore not particularly suitable for logicians). Absence of evidence is not proof of absence.
- spacehome 11y agoOff topic, but absence of evidence is in fact evidence of absence, though depending on the circumstances it might be weak. Say we'd like to know if A exists. There's some evidence for A's existence, which we'll E. The absence of this evidence is ~E. By Bayes' theorem: P(A) = P(A intersect E) + P(A intersect ~E) = P(A|E)* P(E) + P(A|~E)*P(~E) So the probability that A exists is a weighted average of the probability that A exists when there is and is not evidence.(Since P(E)+P(~E)=1) There is a kind of 'conservation of probability'. If the idea that 'E is evidence of A' is to mean anything at all, then it means that P(A|E) > P(A). Hence P(A|~E) must be less than P(A). Another way to say it is that P(~A|~E) > P(~A). And absence of evidence is absence of evidence.
- gesman 11y agoStartup idea: apologeticpressrelease.com Just input corporation, firm or department name. Select multiselect dropdown "what you take very seriously". Select number of "employees|customers|people" (pick one) that will get free credit monitoring. Select for how long. Press [Submit] Input payment information. Press release automatically issued. (we( at )?|CORP_NAME) take your (data|privacy|security|information) very seriously
- thearn4 11y agoIf I owned a credit monitoring company, this is a service that I might be cynical enough to offer.
- Yhippa 11y agoYou're going to put a lot of PR people out of jobs with that.
- aaronem 11y agoThe preferred SV term is "disrupt".
- SlalomStallone 11y agoThat's okay, they can all go work for Donald Trump.
- redwards510 11y agoDon't forget to mention that the malware used was "extremely sophisticated".
- arkem 11y agoThis isn't what most people think of when they hear data breach. There was a breach of DoD security standards when data was transferred to an inappropriate environment but no evidence that the data has been leaked beyond that transfer. I think it's laudable that the Army National Guard would do a breach notification when there's only the possibility of malicious data loss.
- gesman 11y agoMaybe there is some untold, yet upcoming story behind this.
- patrickmclaren 11y agoPerhaps there isn't.
- rebootthesystem 11y ago> files containing personal information was inadvertently transferred to a non-DoD-accredited data center Which could be anything. For example, an AWS server somewhere. Or, how about a VPS hosted by GoDaddy? A lame attempt at humor. Yet, what do we really know? > by a contract employee, Which could be anybody, right? > we do not believe the data will be used unlawfully We don't guarantee...we do not "believe". More detail would have been useful. If my data was with the Guard I would not know what any of the above meant other than my data was made available to a contractor who uploaded it to a random server somewhere and, at the moment, it could be floating in space for anyone to grab. Brilliant.
- fixermark 11y agoTwo things to be aware of: 1) This was an external press release. It's possible communication to the actual Guard had more detail. Or not; it's the military, and they'll tell you what you "need to know." 2) While they don't guarantee the data wasn't leaked, I read that as more in the sense that "The non-DoD-accredited datacenter is outside of our auditing trail" than in the sense that it's actually likely the data was leaked. If you take my state's drivers' license database and uploaded it to AWS, the state can't "guarantee" the data wasn't used unlawfully either, but you can be certain that Amazon has a lot to lose if some failure of their infrastructure gives China access to a list of passport-authorizing documents.
- jtchang 11y agoSo basically someone (who was probably getting paid by the DoD) scp'ed some info to a server he/she wasn't suppose to. This more like a breach of standards. At least they know where the data went. The OPM breach is far worse.
- trengrj 11y agoWhen I read that "an employee transferred data to a non DoD-accreditated data centre", I imagine the employee transferring a dataset to Amazon Web Services or something similar (usually because the tooling in their current environment is horrible). Edit: I just had a look and found AWS is actually DoD-certified http://aws.amazon.com/compliance/dod/ http://aws.amazon.com/compliance/dod/. I wonder what the data centre in question could be.
- jon-wood 11y agoOnly some parts of AWS are DoD certified, and even then only some services in the GovCloud region (which isn't widely available) are fully certified. It's entirely possible some contractor made use of a service which isn't certified still.
- deleted 11y ago[deleted]
- curiousjorge 11y agowho could possibly benefit by having this data? I don't think it's of any use to scammers and criminals.
- lifeisstillgood 11y agoI'm sorry but there is likely to be more to come. "All current and former since 2004" .. No one transfers all the files by accident unless the systems and controls and sheer "WTF am I doing this for" attitude is simply missing. This Inwill guess is the least awful of a series of breaches to be released, as everyone falls over themselves to check their seals.
- fixermark 11y agoIt's likely similar to the British NHS policy failure in 2014. The shear between the tools publicly available on private data networks for analyzing and slicing bulk data and the tools available on cloud networks is wide and growing. As it continues to widen, you can anticipate that more and more tech-savvy mid-level staff in government positions will look at the status quo and say "I could follow policy to the letter, or I could use the cheap-and-easy tools I'm familiar with to get some Goddamn work done and trust that data living in AWS is at least as secure as where it currently lives, in that tool-shed-looking building on the back of the base with the door that doensn't quite latch correctly."
- chasb 11y agoThis seems non-adversarial, more like a violation of DoD's own internal policies. I wonder why they don't say whether they were able to perform any remediation?
- chrissnell 11y agoAs a former ARNG member and a current Army Reserve member, this doesn't surprise me at all. The U.S. military's regard for personal information has been dreadful. Service in the military entails endless filling out of paper and electronic forms and almost every one of them has the servicemember's SSN on them. These forms get filed in filing cabinets, e-mailed around and--quite often--left on desks. The situation is made worse because our pay grades are typically part of the form, too, so a potential identity thief knows the approximate salary of the victim because our salaries are standardized and readily available. Things are getting better and the DoD has switched to a non-SSN identification number but the SSN is still frequently used.
- omegaham 11y agoYep. My dog tags had my SSN on them, which I found to be completely ridiculous, as did my military ID for a while. They started issuing cards with an EDIPI on them relatively recently, which is a step in the right direction, but there's still a lot of work to do.
- stonogo 11y agoWhen that policy was enacted we were still living in the world where the SSN was not the primary means of personal identification. Social security cards used to explicitly say they were not to be used for personal identification, recently enough that mine does. The DOD originally switched to the SSN from the previous service numbers, as in "name rank and serial number". It was a convenience measure, since the service number system was arcane. Service numbers were also public record, and I've read documents indicating that social security numbers were not considered sensitive information (notwithstanding the fact that the DOD didn't have the concept of PII formalized back then). Should the DOD have moved back to another serial number system sooner? Possibly. I'm amazed that they're moving at all.
- reustle 11y agoThe point I take away from this is, how long is SSN going to be a super secret 11-digit pin for your life? Banking online, job forms, etc all use SSN and it gets thrown around everywhere. Are there any indicators that we're working on something a bit more modern for identification?
- rezand 11y agoAhem...I'm just going to leave this here for now on when I spot the following pr cliche http://www.troyhunt.com/2015/07/we-take-security-seriously-otherwise.html?m=1 http://www.troyhunt.com/2015/07/we-take-security-seriously-o...
- deleted 11y ago[deleted]