Slashdot Mirror

The FBI is hiring, so yeah. the klan is getting bigger.

A typical klan rally is 12 guys. One actual klansman and 11 undercover FBI agents.

A law degree used to be mandatory, now it's a large majority.

No and no. A law degree was never mandatory for every agent, the requirement is still in place for the positions that required it before, and it was never even a plurality across all agents, let alone a "large majority".

The FBI does require a law degree for certain positions, but only for a small fraction of the jobs for which they're hiring. The FBI's official jobs site lists a number of career paths for agents, including a number of specializations. Of those, only the legal specialization requires a law degree. Given that the FBI employs everything from snipers to hackers to accountants to chemists, it should be patently obvious that a law degree is not currently a general requirement. Moreover, you can go all the way back to prohibition to see that they were hiring many of those same positions from the very start, none of which required a law degree back then either.

Sweet jesus you're using the X-Files as your source?

When you're making ludicrous claims, the best way to highlight their absurdity is to point out that even over-the-top fiction doesn't take it that far. Why? Can you think of a better way to highlight how absurd your claims are?

A law degree used to be mandatory, now it's a large majority.

No and no. A law degree was never mandatory for every agent, the requirement is still in place for the positions that required it before, and it was never even a plurality across all agents, let alone a "large majority".

The FBI does require a law degree for certain positions, but only for a small fraction of the jobs for which they're hiring. The FBI's official jobs site lists a number of career paths for agents, including a number of specializations. Of those, only the legal specialization requires a law degree. Given that the FBI employs everything from snipers to hackers to accountants to chemists, it should be patently obvious that a law degree is not currently a general requirement. Moreover, you can go all the way back to prohibition to see that they were hiring many of those same positions from the very start, none of which required a law degree back then either.

Sweet jesus you're using the X-Files as your source?

When you're making ludicrous claims, the best way to highlight their absurdity is to point out that even over-the-top fiction doesn't take it that far. Why? Can you think of a better way to highlight how absurd your claims are?

From whom? I was told many years ago by a retired agent who gave a talk at my high school's career day that their unofficial policy was to not hire anyone *under* the age of 30, because they wanted you to have several years of practical experience in some related field before they would consider you for a position.

Looked it up - https://www.fbijobs.gov/114.as...
23 less than X less than 37.

Doesn't matter, I'm still well over a decade to old.

Also, according to this page, "new Special Agents in their first Field Offices earn between $61,100 and $69,900, depending upon the region of the country to which they are assigned.". I've got 15 years of experience and make 3x that. How is the FBI going to lure already-well-compensated, experienced people with that kind of laughable pay scale? Instead they'll get dudes out of college who just want to make enough money to buy some weed, eat some ramen and Doritos, and go back home to live in their parents' basement.

Sure, it sounds like they did .. and it also sounds like this super awesome system had a gaping hole that admin could become anybody else and then just read it, because that user has access

Not the way I read it, sounds to me like as soon as he had access to their user accounts he had access to all the files in plain text, no metion of breaking encryption anywhere.

And then that's going to be the failure point in your system -- all it takes is one guy who writes his password down, and the whole thing is screwed.

I'm not crypto expert, but let's do a thought experiment.

Let's say that I've got a bunch of people, and 3 levels of security.

So, if we want all of the people (all of whom have the lowest level of security for sake of argument) to have access, we get one of two scenarios. You have a single decryption key they all share, and the first person to accidentally leak it screws it up for everyone. Or, you have to build a crypto system which will allow the same information to be decrypted using multiple decryption keys -- and my first thought is the more different ways you can decrypt the more likely it is that someone can break into it by crafting a key which also works because it's no longer unique.

Same goes the other way ... does the decryption for the most secure level also open up all of the low-level stuff? In which case, you can narrow your targets down to just the ones with the most permissive key. Because those give you the keys for absolutely everything.

You could try to have a broker which authenticates you, and from there grabs the key it will need to decrypt and then use that .. but then your broker becomes the target because it's got access to everything.

And, you'll probably have corner cases in which generally someone is only allowed the lowest level of access, but for specific things you can get 'read in' on stuff that needs you to escalate your access -- but *only* for that and nothing else. You could also have cases where you have a second group of documents in the "highest access possible" category not accessible to everyone at that level -- say, the OPR at the FBI where you might be investigating the top people and need to keep that secret from them.

I'm sure there's been literally volumes written on this, by people who have far more qualifications than I on the topic. But in general, I think the whole problem of guaranteeing only authorized users can ever access something at a given time is a hard problem. Because the more permutations on what you're trying to do, and the more people involved in it, the more places where there could be gaps.

Any security system will have holes but it would have been a whole lot harder for Snowden to get hold of the information he did if he had to loiter around peoples offices which he probably had no business being in( read plausible excuse) searching below desks for handy post-its, that or find an accomplice that had the correct encrytion codes. So I agree that no system is completely secure, but they certainly can be more secure.

but could they not implement a system whereby sensitive files are encrypted and only accessable by authorised users(correct security clearance)?

Sure, it sounds like they did .. and it also sounds like this super awesome system had a gaping hole that admin could become anybody else and then just read it, because that user has access.

That would involve the users managing their own passwords on the encryption software in question

And then that's going to be the failure point in your system -- all it takes is one guy who writes his password down, and the whole thing is screwed.

I'm not crypto expert, but let's do a thought experiment.

Let's say that I've got a bunch of people, and 3 levels of security.

So, if we want all of the people (all of whom have the lowest level of security for sake of argument) to have access, we get one of two scenarios. You have a single decryption key they all share, and the first person to accidentally leak it screws it up for everyone. Or, you have to build a crypto system which will allow the same information to be decrypted using multiple decryption keys -- and my first thought is the more different ways you can decrypt the more likely it is that someone can break into it by crafting a key which also works because it's no longer unique.

Same goes the other way ... does the decryption for the most secure level also open up all of the low-level stuff? In which case, you can narrow your targets down to just the ones with the most permissive key. Because those give you the keys for absolutely everything.

You could try to have a broker which authenticates you, and from there grabs the key it will need to decrypt and then use that .. but then your broker becomes the target because it's got access to everything.

And, you'll probably have corner cases in which generally someone is only allowed the lowest level of access, but for specific things you can get 'read in' on stuff that needs you to escalate your access -- but *only* for that and nothing else. You could also have cases where you have a second group of documents in the "highest access possible" category not accessible to everyone at that level -- say, the OPR at the FBI where you might be investigating the top people and need to keep that secret from them.

I'm sure there's been literally volumes written on this, by people who have far more qualifications than I on the topic. But in general, I think the whole problem of guaranteeing only authorized users can ever access something at a given time is a hard problem. Because the more permutations on what you're trying to do, and the more people involved in it, the more places where there could be gaps.

Just because he works for the FBI doesn't mean he is computer literate. The majority of them are nothing more than federally paid beat cops doing missing persons investigations and helping out when other LE can't do the investigation themselves. I think you and others are giving him too much credit because he works for a three letter government agency.

My post suggested that even Joe Sixpack should be able to uninstall what he installed, given that the directions are included with
the product and on the product's web site.

However.....
FBI agents are far from beat cops. The requirements state that you must possess a four-year degree from a college or university accredited by one of the regional or national institutional associations recognized by the United States Secretary of Education. You must have at least three years of professional work experience. You would expect this sort of person to write thing (like passwords) down in a safe place, and remember where the directions for removal could be found. (It took me 27 seconds to find the page on the web).

sure, dumb.

https://www.fbijobs.gov/1111.asp

Or not.

Or join the feds. When they harass you again, there's a chance you'll be able to arrest them.

All they would have to do is come from a country that would allow them to carry weapons onto the plane too.

International flights would probably operate under different rules if for no other reason than the lack of very many countries that permit their citizens to carry firearms. The 9/11 flights were domestic, so let's confine our discussion to that arena.

One or two air marshals hidden within the passenger

Sure, and where does the budget for that come from? There are over 25,000 domestic flights in the United States each day. Accounting for three shifts and building in some overhead for sick days/vacation/training/etc you'd probably need to hire ~150,000-200,000 LEOs to put two air marshals on each flight. If they are classified GS-10 (that's where the FBI starts their special agents) they'll be making ~65K a year. Toss in their benefits, training, etc and the cost per employee is close to 100k.

And something that you might not be noticing or recognizing is that the plane is in a pressurized environment once at cruising altitude. While this might not automagically cause the cabin walls to explode sucking passengers out if you shoot through them (it could)

That's FUD. A .45" hole is going to cause depressurization. It's not going to "explode" the cabin walls.

it very well can deplete the oxygen levels and air pressure rapidly creating a life threatening situation for the passengers should you miss your target while trying to be a hero.

That's what the oxygen masks are for. And it has nothing to do with "being a hero". It has everything to do with saving your life. Self-defense is an inalienable human right. It does not cease to exist at cruising altitude.

Good thing the people who showed up on this guy's doorstep were FBI agents, rather than cops who are usually "from lower income backgrounds, with a chip on their shoulder," then - right?

Because I'm pretty sure that people meeting the Special Agent requirements are going to make pretty solid money (entry level, agents will average ~60-70k), and also already have at least a 4-year degree, and in many cases, additional professional certifications.

All of which leads me to suggest that... your broad-brush characterizations of cops is: a) not applicable to FBI agents, and b) therefore irrelevant to this discussion, since it was federal agents from the FBI who showed up at the guy's house to retrieve their device. It wasn't a bunch of local BFE cops showing up going, "Give us the flashy thing or we'll pants you, NERD!"

It's enough to drive the pissant commie sympathizers to bother someone else. Or maybe not. [nytimes.com]

Precisely the problem.

The FBI has a similar problem - you can smoke (but not inhale) and become President (Clinton, Bush II, Obama) - but you can't join the FBI if you answer honestly.

Actually, the FBI has relaxed those rules somewhat:

http://www.fbijobs.gov/52.asp

Here's a story about the policy change:

http://www.washingtonpost.com/wp-dyn/content/article/2007/08/06/AR2007080601260.html

You don't know what they were searching for.

You are only repeating a rumor.

The FBI employs about 12-13,000 special agents whose job it is to investigate violations of 300 or so federal statutes.

That is not a particularly large number, when you come right down to it.

In the American federal system. investigation of the "heinous" crime is almost always a local and state responsibility.

The rare terrorist act makes headlines. White-collar crime - economic crime - comes closer to the truth of what the FBI is all about:

FBI: Internet Fraud Rates Rose 33% Last Year

E is actually the only point with any validity, and is a major one.