Slashdot Mirror
Hacking Crime Victims to Remain Secret
outlier writes "The AP is reporting that federal law enforcement agencies are offering to keep the names of companies that have been victims of major cracking crimes secret. The goal is to encourage victims to come forward, so that the government can 'prosecute cases while at the same time achieving the kinds of protection and addressing the concern that the business community rightly has.'" My favorite part is how FBI agents will now "discretely" arrive at victims' offices.
We do have in Brazil a police force specialized on internet crimes but sisnce the majority of the attack victims are off-shore, it's kind difficult to track down the crackers.
Faith can move mountains. I prefer dynamite.
Companies that get hacked are, of course, only interested in recovering and getting back to their core competency. Nobody hsa time for forensics or any other bullshit, unless they've got an export control box hacked or we're talking classified data, in which case legislation dictates that more measures are required.
This is good because I beleive then that a lot more companies will come forward with hacking tales, more development will be done to plug holes, more people will be able to talk about hacking, more people will be aware of the dangers, more people will become educated about hacking and virueses and the like, and we will have fewer "I cant find the any key" tech support calls and fewer viruses propagating like mad.
Help I'm a rock.
Alcohol and Calculus don't mix. Don't drink and derive.
You mean they used to arrive all lumped together? No wonder people got upset!
Learn to spell, guys...
No...
THIS (o)(o)
is a bust
-Fedreral Breast Infect0rz
And snail-mail correspondance will arrive in plain brown wrappers????
> My favorite part is how FBI agents will now "discretely" arrive at victims' offices.
The guys in black trenchcoats? Uh, those are our network consultants. Yeah, network consultants.
Sheesh, evil *and* a jerk. -- Jade
Maybe the courts should just start calling the parties H4X0R and H4X0R3D...
I'm the Devil the Windows users warned you about.
Nothing beats security through denial.
"Uh, I wasn't hacked, nope. Must have been Corporation X."
And WTF is this?
Government efforts to tighten Internet security and investigate online attacks have long been hampered by reluctance from companies to admit they were victims, even in cases where executives quietly paid thousands of dollars in extortion to hackers.
Ok, someone needs to prove this, otherwise I get the highly suspect that it's some government propaganda. Honestly, who pays a script kiddie to remove the pr0n and racist/anti-gay shit from their site?
-- El Sacarino tiene gusto de la chocha
This is bad, wrong, and just brain dead.
If the company can't keep it's information secure, why should I own any of that company's stock then?
Information crimes should be treated the same way as a real robbery (just we have a smarter crook to deal with).
This is on the same level has cooked books IMHO.
III.IIVIVIXIIVIVIIIVVIIIIXVIIIXIIIIIIIIVIIIIVVIII
This is an excellent idea. The amount of information that disappears down a black hole due to copmanies keeping quiet must be gigantic.
A good idea from the FBI..? Next thing you know, the CIA will start acting intelligently and the government will start governing...
If you can't see this, click here to enable sigs.
them: "Someone has testified against you, we wont tell you who it is, and we can't tell you what they said either".
you: "Umh ok".
FRA: STFU GTFO
I think those who pray to a talmudic god of vocabulary need to understand that language is a living thing.
I agree that confidentiality is important in some crimes. For example a woman who has been raped shouldn't have to have her name splashed on the front page.
But... if my bank or credit card company has a habit of getting hacked (ie. lax securtity) I figure I have a right to know about it.
Just my $.02.
People couldn't type. We realized: Death would eventually take care of this.
Hi. We're from the FBI. You're under arrest for hacking. We cannot disclose what you did or who you hacked. Just jump into our jail.
There must be a dozen or so sites in each country that take a list of recentltly defaced web sites, I guess this isn't as severe as screwing up millions of credit card numbers.
Shouldn't the consumer be aware if someone who they gave there credit card details has been hacked and now they are exposed? It comes down to, if your a victim, you want to know.
Analytic & algebraic topology of locally Euclidean meterization of infinitely differentiable Riemmanian manifold
Isn't this sort of like the family who's teenage daughter gets pregnant and they don't want anyone to know because "what will the neighbors say?!?!"?
FLR
My favorite part is how FBI agents will now "discretely" arrive at victims' offices.
In my experience, the FBI can be extremely discrete when they want to be. I work for a company that provided some important information to the FBI after September 11 last year. There would on occasion be two or three agents in our office, who always showed up driving an unmarked car, and wore casual attire. Most of the people in our office had no idea the FBI was even present.
The article says this isn't an issue because most hacking computer-crime investigations end in a plea deal, but how willing will suspects be to plea if they know they have an out at trial?
Case in point... AbiWord vs. PayPal.
I'd certainly like to know that the California State agency which kept my personal information had been hacked into. Same for anywhere I have or might be placing sensitive information.
Bad policy, bad! No treat for you!
A feeling of having made the same mistake before: Deja Foobar
However, in the case of companies that don't spend an appropriate amount on infosec, fear of public knowledge of their lack of security is often the only impetus to spend any money at all. Case in point: as the only "computer guy" (read:webmaster) at work, any problems with systems, be they internal or external, get blamed on me. I've fought tooth and nail for training (nope), a new network architecture (confidential documents, including employee data and customer financials, are stored on a Win2k box that has no firewall, no A/V, nothing), even just the ability to install freeware solutions (fuck spending an appropriate amount of money, just let me spend some time, please) have all gone by the wayside. The only time I can get approval for anything is when I lay out specific scenarios of stolen data being released publicly and the ensuing customer backlash over the lack of security. Without that hammer, I've got nothing. And since the only infosec experience I have is that which I can get for free, on my own time, I need all the hammers I can get.
Wait a minute, I'm confused here. The government is doing everything it can to protect the names of companies that have deployed inadequate network security practices from getting out but they're also making it their mission to expose companies that have employed deceptive accounting practices like Enron and MCI. The bottom line is that they both point to problems with the running of the company and if the company is publicly held then this information should be exposed and the incompetence dealt with.
don't tell them that!
What, the bit about an agency or a government?
any of it!
Right. You're under arrest for hacking.
don't tell them what they're under arrest for!
We can't just arrest them, can we?
we do it all the time!
But that's what morally corrupt dictatorships do and we're not one of those, we're from a democracy, right?
oh, great, next you'll give the whole thing about where we are from away, just why don't you wave the flag, show 'em a picture of your mom and ask if they'd like some apple pie! fer chrissake!
Ok, we cannot disclose who you are, what you did or who you did it to, who we are, what we are here for, what you may or may not be charged with, where we are taking you or anything else. We're not even sure if we are at the right address, but just come with us.
quietly.
A feeling of having made the same mistake before: Deja Foobar
My favorite part is how FBI agents will now "discretely" arrive at victims' offices.
- Yes. I've been looking for you, Neo. I don't know if you're ready to see what I want to show you, but unfortunately you and I have run out of time. They're coming for you, Neo, and I don't know what they're going to do.
- Who's coming for me?
- Stand up and see for yourself.
- What, right now?
- Yes, now. Do it slowly. The elevator.
This is of marginal value because while it may keep things under wraps while the hack is occurring, if the hacker is caught (the goal, after all), then they have the right (in the U.S. at least) to face their accusers. Barring a rather broad-sweeping gag order, the press will get wind of it. And given that the bait here is for the company to remain anonymous permanently so users of that company to not lose trust in that company, this is of dubious value.
Plus, IF the hacker (remember a lot of jobs are done from the inside) catches wind that the FBI has been contacted and is being asked to be discrete, this is a new weapon. They now know that they have brand new button to push that the company would, for whatever reason, really not want pushed.
Just a thought.
My
Limekiller
I remember reading in some book about internet security that some corporations dont want to deal with the hassle and the wait and the apathy of the feds for cyber crimes. They have a private jet and some big guys with baseball bats. Vigilantism is illegal, but if more crackers knew about this i'm sure the number of large scale attacks would decrease. Does anybody know anything more about these private computer crime 'investigators'?
"Sic Semper Tyrannosaurus Rex."
So is this saying that hacking is even more humiliating, more personally damaging, more vicious than rape or murder (or any number of other violent and cruel acts) -- so much so that we have to shield its victims from any public knowledge of their being victims? Or maybe are we saying that corporations get whatever they want from our justice system? (*cough* Microsoft penalty judgement *cough*)
Ummmm, that isn't even constitutional. The accused has a right to confront their accuser. Do you really think the accuser is going to keep quiet about who the victim is? Doubt it, unless they give him some real incentive not to. Either way, with lawyers, relatives, friends etc, the true story is going to leak out somehow. If the FBI *REALLY* thinks this is going to remain secret, they have more than a few problems...
*Condense fact from the vapor of nuance*
So now not only is the electronic "proof" easily faked, now you don't even have to tell the hacker whom he supposedly hacked?
Great! The perfect infrastructure to put arbitary people in jail. You can frame anyone!
And how can the hacker prove to the judge that the alleged victim had something to gain from framing him? And it makes it impossible that someone can can read about the trial in the newspaper and help prove the hacker's innocence.
Obviously they want to get rid of Kevin Mitnick for good this time.
The reluctance most companies have to present evidence they have been jacked is not because they fear the effect it will have in their customers. This fear goes much deeper and touches the very soul of many companies. It is a problem of competence, knowledge, expertise and information control. Many companies control quite badly or don't have any control over the information exchanges ocurring inside their infrastructure. It is a mess that no one can get an hint of and no one really cares. While money keeps coming, they will not worry sharing its local network with third parties (some business centers work that way), sending tons of internal data through simple e-mails out to Internet (no cyphers, no filtering), sharing local networks with customer's ones (how many ISPs work like that?) and many, many more.
It is curious to note that these cases are even more frequent among corporate strucutures, specially among holdings. And no one cares when one company gets sold and still keeps using the common corporate resources. And some do use these security breaches for their purposes.
So why companies want to hide information? Because they don't want people to mess up in their "internal" affairs. Roughly this is the same type of story like the county sheriff meeting the feds in its town. He may know he has a problem but he will be more happy to see these suits outta there ASAP and leave people solve its own problems. The same goes to most companies. They will not invite feds because they fear publicity. They will not invite them because they prefer to leave the mess for themselves, instead of having some "outsiders" sniffing all around and giving too many questions.
Not long ago I was in such situation. I came in in a "no publicity, no scandals, all confidential, internal and top secret" agreement. However, some guys didn't calm down until they smoked me outta the company. According to my recent data, they keep living exactly the same way as they did. While they fill their pockets, they don't care for shareholders, clients, partners or concurrents. And frankly it seems that their shareholders don't worry either.
Oh well, that battle is really lost. OK, I realize that. Language has evolved beyond reach and we can't possibly managed to do all the education to revert it.
But what should I call myself? Or rather, what should people call me when they want to pat my back for something cool I did on the computer? I mean, everybody likes that, and we all need that, don't we?
Computer professional? Nah, I can't even accurately describe a Turing machine. I have merely basic training in computer science, on a "tools" level.
Computer hobbyist? I can do a lot more than most people, I can learn things fast, and I'm trained enough to point out flaws in the things many computer professionals do, including really good ones. Besides, I'm getting paid for it, even though the job market isn't that good.
Geek or nerd? Well, yeah, I guess I am, in some respects, certainly, but it doesn't really describe what I do accurately.
Well, many people gets a real identity crisis from this...
Employee of Inrupt, Project Release Manager and Community Manager for Solid
Criminalizing hacking is probably a mistake. It's a natural impulse to explore networks and work past barriers. It's no coincidence that the word "hacking" describes both creative programming and "malicious" network connections. They both stem from the impulse to explore systems.
The Government is now voicing concern about our "National Information Infrastructure" and its vulnerability. Passing tough laws and increasing enforcement is exactly the worst thing we could do for that cause. It will merely grow "hothouse flowers" - vulnerable networks that will not be probed by ordinary people (because they're scared) and will remain vulnerable for cyber-terrorists or organized crime.
Indulging the weakness of our corporate information security will be a never-ending spiral. Instead we should drag these hothouse flowers out into the real world and let natural selection take its course. In fact, the government could help most by offering bounties to people who hack into important facilities. Of course these bounties would be added to the tax bill of the corporation responsible for the security weakness. If most of the malicious hackers were reporting to the government, there'd be no way for "victims" to hide the incidents, and they could be publicized so customers and shareholders can react appropriately. That's how free markets are supposed to work - people buy and sell based on information.
Small scale hackers and script kiddies are like the constant barrage of viruses that keeps our immune systems on their toes. If we manage to scare them all away, we become the "boy in the bubble".
you're an immigrant charged with a crime with "national security" implications.
The SEC is pretty clear that a company must report significant losses to stockholders. If a company is hacked and has millions of dollars in damages, aren't they committing a crime by not reporting that to their stockholders? (reminds me of the Mitnick trial).
Alright /. decide on the terms.
/. decide on the style guide so we know what we are talking about.
Are we talking about hacking or cracking?
The title talks about hacking crimes, and then uses cracking in the paragraph. So please
Even more worrisome is the mention in the article that they want to make hacking details exempt from the freedom of information act. This is a small, but very significant, step towards a fascist police state. With the overall prevalence of computers in society today, anyone would be liable to be called a "hacker", and prosecuted secretly.
It's important for us to realize that you have certain concerns as victim companies that we have to acknowledge," FBI (news - web sites) Director Robert Mueller said. He promised, for example, that FBI agents called to investigate hacking crimes will arrive at offices discretely without wearing official jackets with "FBI" emblazoned on them
In other words, they are probably coming in "discreetly" to investigate the company that is hacked, not the hackers. Having a hoard of FBI agents mulling around your office is not the best publicity, worse at times than being hacked and having "J00 R 0WZ3R3D, PAY ME $1000000" tagged on to one's webpage...
Having your webpage hacked, people know you have a security issue. Having the FBI swarm your office, people imagine for themselves what you have done to have them there. Anyone care to guess which is worse?
When keeping a secret, make sure others do not even know you are keeping a secret, lest their own imaginations persue a worse scenario than reality - phorm
at the cost of consumers of course.
>along with any sensitive corporate disclosures that could prove embarrassing.
Embarrassing? I'm sorry, but if my bank has an incompetent IT department, uses crappy software, has a poor security policy, etc then I should find about it in the paper alongside the police blotter which lists every drunk, domestic fight, and pot possession in the county.
The meat packing industry is the same way. They can recall tons of dangerous product without telling the press who the meat was sent out to. For instance it was all sent to McDonalds or Subway then those companies have the choice to tell you. Your safety, and life in some cases, is second to their PR.
Government is supposed to protect all interests without giving in to one side. Sadly, those with the resources get what they want and there isn't even a popular opposition party to call BS on laws like this.
At first, I was thinking in terms of a "rape victim's" perspective. Yes, it's "damaging to your reputation" to be seen as weak, vulnerable and insecure, but then again, this is PUBLIC INTEREST not PRIVATE INTEREST.
People who are considering their position as share holder deserve to know the state of the company they own a share in. People who are considering buying into the a company deserve access to the information about what they're buying. As far as I'm concerned, it's a consumer right!
Corporate secrecy and other shenanigans has been what has led to many of the problems our economy is suffering now.
Another poster had another view from the perspective of the "accused" which I also feel for. It's the leverage of a plea. If a person is merely suspected, presenting proof isn't required? I'm sorry, but no! It's 100% necessary so that a person can adequately and fairly defend himself if unjustly accused. The only thing resenbling "fair" is when the accused is actually guilty and actually knows what he did... and even then the accused can't know for sure.
This idea places too much balance in favor of government law enforcement and corporate interests and is completely against "the people." This shouldn't be happening.
From the article:
"Companies that worry too much about public response underestimate the public's ability to assess the situation with some sophistication," [the FBI spokesman] said. "If a bank robber sticks a gun in a teller's face, the public is not confused about who's fault that is."
What about companies that provide little to no protection to their networks? Is that still the same as a robber sticking a gun in a teller's face, or would that be more akin to say, someone walking into the bank, into the unlocked vault, and walking out with everyone's valuables? And can the public still asses the difference with any level of sophistication?
https://www.eff.org/https-everywhere
Since when hacking is a crime? It's ***CRACKING*** that's the crime!!!