U.S. Interior Dept. Unplugged... Again

IO ERROR writes "The U.S. District Court ordered the Department of Interior to take all its systems offline for the third time, saying that its systems were too insecure to be left open. Among the systems to go offline are those that process payments owed to American Indians and Internet access in schools on Indian reservations. DOI employees cannot use the Web or send or receive e-mail."

Comments

I wonder about the old paper systems

[Ckwop]

If people can't secure the computer systems i wonder how secure the old paper based systems were?

I mean, with a physical system u need physical access but I bet those old systems were probably quite easy to subvert :P

Simon.

Re:I wonder about the old paper systems

[millahtime]

" I bet those old systems were probably quite easy to subvert"

I doubt they were easy to subvert. First you have to gain access to the facility, then you have to have access to that area and then you have to have access to the files. It is not that easy to just stroll in there and get a copy of them.

Secure data would be physically secure. It's not like you can just walk in a building and get that stuff that is locked up. It's pretty tough.

Re:I wonder about the old paper systems

[jsprat]

Unless you're the garbage man...

You'd be surprised what people will just throw in the trash.

Re:I wonder about the old paper systems

[roboros]

If people can walk into a secure mainframe room and steal mainframes, a determined person should be able to steal papers. Social engineering can be very powerful, just ask Kevin.

Re:I wonder about the old paper systems

[AllenChristopher]

"Secure data would be physically secure. It's not like you can just walk in a building and get that stuff that is locked up. It's pretty tough."

You need to read "Surely You're Joking, Mr. Feyman." Feyman raids the safes that contain the plans for the atomic bomb repeatedly, both for entertainment and to get work done faster. He walks through a hole in the fence around Los Alamos repeatedly, always exiting through the gate. The guard doesn't catch on until he's done it many times.

I was able to get almost anywhere in my university dorms with a penknife, despite locked doors at the end of every hall.

The problem with locks and guard and secure areas is that they're so visually impressive, it's easy to assume that they will work. With bicycle couriers and janitors moving around all the time, workers get used to unfamiliar faces and forget to check ID.

Re:I wonder about the old paper systems

[Kronovohr]

1 entry found for UNSECURE.

UNSECURE

\Un`se*cure"\, a. Insecure. [R.] --Milton.

5 entries found for INSECURE.
insecure adj.

1. Not sure or certain; doubtful: unemployed and facing an insecure future.
2. Inadequately guarded or protected; unsafe: A shortage of military police made the air base insecure.
3. Not firm or fixed; unsteady: an insecure foothold.
4.
1. Lacking stability; troubled: an insecure relationship.
2. Lacking self-confidence; plagued by anxiety: had always felt insecure at parties.

holy crap indeed

Re:I wonder about the old paper systems

[theodicey]

Everything about their facility was insecure.

they were infiltrated by the judge's appointed special master, a lawyer named Alan Balaran, with only minimal social engineering.

Re:I wonder about the old paper systems

[wytcld]

i wonder how secure the old paper based systems were

That's the center of the legal case. DOI systematically lost records which - if kept and honored - would have resulted in billions of dollars in lease payments to Indian tribes for natural resources (mining and oil) extracted from their reservations by corporations contracted with DOI. The judge may be less concered with security from outside hackers, than with the likelihood of DOI insiders continuing to corrupt and alter the records by setting up the systems so that they themselves can continue to engage in behaviors which have already resulted in judges holding DOI in contempt of court.

It's not enough that we took most of the Indians' land; we've been continuing (through our kindly federal government) to steal from under what little land they have left. Even under Clinton DOI wasn't playing straight on this; you can imagine how much better it's been under Bush. The problem is that under any reasonable estimate there are enough billions involved to qualify as a serious budget item. Of course, the Indians have oil and other natural resources, and in the past behaved as "terrorists," so if anything we're consistent....

Re:I wonder about the old paper systems

[ScrewMaster]

Well, I don't know. There was a story on the news this morning that I heard before I left for work. Some dude (or dudette) broke into a major IRS facility, easily bypassing all the "security systems" that were in place. Interestingly, the reports indicate that no confidential tax information or anything else of consequence was stolen, however (and this is remarkable) the pop machines were ripped off. In any event, I'm not sure that your belief that physically secure is all that secure is true. This person or persons unknown could presumably have rifled all the file cabinets in the place if they had wanted to.

Re:I wonder about the old paper systems

[Obfiscator]

The difference being, of course, that he was a trusted employee who happened to be working on the bomb, not just someone who came in off the street.

But I dunno, maybe a bum just passing through town could have done the same thing.

Re:I wonder about the old paper systems

[Genda]

Apparently you've not read about the millions of dollars stolen from the American Indians by past operators of the BLM->Office of Indian Affairs... an office can only be as secure as the crooks, er, I mean beaurocrats that operate it...

Genda

Re:I wonder about the old paper systems

[innerweb]

workers get used to unfamiliar faces

Maybe in your experiences, but where I worked, that behaviour would have gotten that unfamiliar face shot. Noone messed with the rules. The SPs carried live loaded ammo. They did shoot one person while I was there. He lived, but went to jail.

InnerWeb

Re:I wonder about the old paper systems

[k_head]

What's amazing to me is how little of this has hit the maintsream press. Wasn't Gale Norton held in contempt byt he court? Imagine if a clinton cabinet secy was held in contempt how the press would pounce on it.

Billions of dollars were literally stolen and the networks were ordered shut down at least three times and not a peep from the press.

So much for the "liberal press" theory.

No web at work ... the humanity ...

[petabyte]

DOI employees cannot use the Web or send or receive e-mail.

*thinks about what he does at work*
So they're letting everybody go home early then? :)

Re:No web at work ... the humanity ...

[SeinJunkie]

So they're letting everybody go home early then?

It's the government, they already left.

Re:No web at work ... the humanity ...

[WebMasterP]

No QVC isn't invasive and annoying enough. He's probably calling up all the door-to-door sales men and Jehovah's Witnesses he knows.

I wonder if I could make money with uselesscrapyouthinkyouwant.com...

Re:No web at work ... the humanity ...

[b12arr0]

Either that or he has telemarketers as his backup plan.

Re:No web at work ... the humanity ...

[yoriknme]

I work for the government, and I'm still here. Nothing like stereotypes.

Re:No web at work ... the humanity ...

[Quino]

and you're on Slashdot.

No broadband at home? :)

Here's the original occurence

[klipsch_gmx]

...as reported by internet.com. Interestingly it seems that even the previous time was not really the first?

"For the second time in less than two years, a federal judge has ordered the Interior Department to disconnect from the Internet in order to protect $1 billion in American Indian money managed by the agency.

U.S. District Judge Royce Lamberth said Interior's refusal to cooperate with a court-appointed master who wanted to test the security of Interior's systems, prompted the decision. The government claimed it did not cooperate with Security Assurance Group of Annapolis, Md., because they could not agree on the "rules of engagement."

Re:Here's the original occurence

[skrysakj]

There are no such things as rules of engagement. All bets are off, all techniques are viable, no holds barred.

Dress up as a tech guy and talk you way in? Go for it.
Hack through someone's PC, why not?
Send in a small remote control vehicle to snoop? Definitely.
Fake some IDs, listen to employee conversations at a nearby bar after work, sleep with employees and get them to tell secrets, go through trash, make phone calls, take photos, plant bugs, rob, steal, cheat, lie.....

That's how it's done "for real", so why not train that way? Why not TEST that way?

What's wrong with "Train like you fight, fight like you train"?

I'm glad they were shut down if they threw a hissy fit because they couldn't agree on "rules of engagement". Wake up to the real world ladies and gentlemen.

Re:Here's the original occurence

[MoneyT]

Well that's not nessesarily what's meant by ROE, they may mean things like between hours X and Y no tests can be made because critical backups are being done. While no attacker will wait for backups to finish, this is a reasonable request unless the security people feel the need to test the backup software.

There are a few legitimate rules that you need to set in place before you can do something like this, like a set of IP ranges to be used or something. They can find their way in, but there's no point in giving some poor sys admin a heart attack when a bunch of odd IPs start showing up.

Re:Here's the original occurence

[Piquan]

Fake some IDs, listen to employee conversations at a nearby bar after work, sleep with employees and get them to tell secrets, go through trash, make phone calls, take photos, plant bugs, rob, steal, cheat, lie.....

...mug the IT manager for his SecureID, blackmail the tape monkey for backups, assassinate the night guardsman, sure, whatever.

Less severe? One part of a real attack might involve calling in a bomb threat to get one key employee away from his desk. I suspect that it may be better to simulate that part rather than panic the entire building: have one of the high-ups that you're working with call the employee away from his desk for a half hour. Or something.

Yes, the real world doesn't play by rules. But if testing causes more harm than it would have prevented, then it shouldn't take place.

Re:Here's the original occurence

[Anonymous Coward]

Fake some IDs, listen to employee conversations at a nearby bar after work, sleep with employees and get them to tell secrets, go through trash, make phone calls, take photos, plant bugs, rob, steal, cheat, lie.....

Let me guess, you work for the Interior Department? Nice try.

Re:Here's the original occurence

[cmowire]

If critical backups get messed up because of security testing, that would be a security hole.

Having the sys admin go spastic is a good thing for them, because that means that there's somebody watching for stuff. If they know the IP addresses, they can just block those addresses if they don't want the results to turn out bad.

Re:Here's the original occurence

[skrysakj]

If critical backups get messed up because of security testing, that would be a security hole.

Amen. My point in a nutshell.

This a critical system, this is the real world. No holds barred. Now, abomb threat to clear the building as a "test" is severe, yes. It's costly, causes a panic, and may not be appropriate. But, it needs to be tested for as well (maybe in conversation, such as "What are your procedures for a bomb threat? Do you lock the doors behind you and log out?) or do it on a Saturday. Hell, even announced it is a TEST bomb scare, people will go through their routines and procedures and security holes will come to light. But make sure it is done at an unknown time, and with unknown factors to make it as real as possible.

Re:Here's the original occurence

[Bozdune]

No, I've seen this kind of sissy fight before. Believe me, the "rules of engagement" were purely electronic. They were probably arguing that they didn't want any "disruptions" of their service. Now they have a big disruption shoved right up their asses, well-deservedly so IMO.

Re:Here's the original occurence

[MoneyT]

but even if it is a hole there should be a specific day that that testing is run so that an additional backup can be made. Just because you are testing the security of your system doesn't mean you shouldn't be able to recover if you find a fatal problem.

"Larry, Moe & Curly Consulting"

[grub]

Why would systems with access to funds be connected directly to the net? No system with that level of risk should ever be connected to the net unless there's a damn good reason. Even online banking webservers are throughouly isolated from the core banking systems. This is just sheer stupidity.

Re:"Larry, Moe & Curly Consulting"

[ackthpt]

Firstly you can blame the system.

What about when the people who spam fake PayPal, BofA, Fleet, etc. try their luck spamming for native americans, to con them out of their ID/Pin/Password, whatever to steal their money? At some point good security depends upon the end user.

Re:"Larry, Moe & Curly Consulting"

[grub]

then how exactly do they update your bank account?

Online banking allows you to play with your accounts. If it's hacked it's your data they screw with. The entire bank doesn't become a victim.

Your[sic] one of those bozo's that says "I'll never use my credit card online"

I use my card online all the time.

Not to mention a number of "private" networks use the internet as a backbone.

They're called "VPNs". Good luck hacking a properly maintained one anytime soon.

I know exactly what I'm speaking about. Go back to sleep.

Re:"Larry, Moe & Curly Consulting"

[IO ERROR]

Why would systems with access to funds be connected directly to the net? No system with that level of risk should ever be connected to the net unless there's a damn good reason. Even online banking webservers are throughouly isolated from the core banking systems. This is just sheer stupidity.

My understanding of the history of this is that DOI has had the least secure computer systems of any U.S. government agency, and have been virtually overrun with cracker activity. It's pretty obvious that someone who knows little about information security, or knowing the government, a LOT of someones, led to this occurring, as I pointed out, for the third time.

As you said, there's no excuse for sensitive systems such as that to be exposed to the Internet, but it's not the first time and probably won't be the last. In the book At Large, author David Freeman points out that at one point, the controls for the Hoover Dam were accessible from the Internet. That's asking for people to DIE, and that's not cool...

Excuse me, someone's at the door. He says he's from Homeland Security...

Re:"Larry, Moe & Curly Consulting"

[kfg]

In the old days it used to be hard to get small businesses to expose themselves to the net at all. They were paranoid about running so much as a webserver for simple customer services.

Nowadays it's getting tough to convince them they need to keep a computer offline to protect sensitive core business data, even if it means a bit of sneaker netting now and again.

Perhaps times will change again as they swing back to paranoid.

Real men may upload their data to ftp and let everyone else mirror it. Smart men pull the ethernet cord. If nothing else you don't want the IRS/SEC to be able to pull your data off of someone else's server. You can't wipe what you don't have sole possession of.

KFG

Re:"Larry, Moe & Curly Consulting"

[bmwm3nut]

...a good 40% of retailers use the INTERNET to connect to the bank...

it's even worse than that. i know a guy who works at a credit union. his job is to do end-of-day, end-of-month, etc processing. one of his jobs, is to ftp the transactions to/from visa everynight. it's not sftp or any other encrypted connection. just plan text ftp right over the internet. no one at the place will listen to him about how insecure that is! and just think, if visa is doing that for this credit union, i imagine that they're doing it for all the banks/retailers they deal with.

Re:"Larry, Moe & Curly Consulting"

[Anonymous Coward]

That has nothing to do with your original statement. You said they are not connected. Explain properly.

Well, you asked nicely. When a customer connects to an online bank they aren't directly connected to the banking core. They're on a webserver that's isolated well enough to prevent compromising the main banking systems. The passwords and login credentials aren't usually stored on the web machines, rather the info is passed through to other secured machines. This way if the web server is comprimised the passwords are safe. There are usually firewalls or other security between all these systems.

The key is to isolate the systems and only allow the bare minimum amount of talk to get the job done.

Re:"Larry, Moe & Curly Consulting"

[Texas Rose on Lava L]

Not to mention credit bureau's, the BMV (or DMZ depending on your state), etc. etc.. Stop spreading your FUD

I've heard stories about people in Korea not seeing their family members for 50 years because of the DMZ, but I never realized they were just waiting in line for their driver's license. And I thought is was bad wasting a Saturday afternoon at the DMV/MVD/BMV/whatever. Guess I shouldn't complain.

Re:"Larry, Moe & Curly Consulting"

[DR SoB]

Not quite. They _DON'T_ PGP encrypt it, it's sent plain text. EVER BANK I'VE WORKED WITH in USA uses plain text to transfer the file. I have seen the PGP encrypted file, but that's only for Canadian banks.

Yes, FTP using Plaintext is risky. That's why Vital (Visanet) would force the LINK/LINE between the companies to be a. encrypted, or b. a VPN.

No retailer want's to spend the $10,000USD on a business class version of PGP (I've investigated it before). Canadian retailers generally get the retail version and make it some guy's duty to manually encrypt the files.

Re:"Larry, Moe & Curly Consulting"

[DR SoB]

Not quite.. There is a translation that takes place, I'm not talking about X.25 over TCP, I'm talking about banks that have NO TCP connection available for there mainframes, so they had to buy a server that sits in front of the mainframe that listens on TCP takes the credit packet and translates it into the banks X.25 format. The reason is many retailers want to use TCP type POS's but the bank's (well, SOME in Canada) don't support a front end TCP. Does that make sense now? And yes, I've also worked on networks that run X.25 over TCP.

X.25 is definitely more complicated then setting up a software VPN, and I'm not talking about simply typing in a DNA and connecting with pre-configured software. As for a hardware VPN there is no setup there, it's transparent to the end application, could it get simpler then that?

Now, back to my inane ranting and trolling..

Awww, man...

[Anonymous Coward]

There goes my sweet FTP server with the 0 day warez and the fat pipe!

No OS mentioned in the article

[$calar]

I wonder who the culprit is.

Re:No OS mentioned in the article

[Anonymous Coward]

Here's an article from a recent incident. No Trust: Hacking the Department of Interior

Since the article doesn't mention, I'll ask:

[burgburgburg]

Does anyone know what system(s) they are running? What (if anything) are they using as firewall(s)? What types of servers are they using? What database(s)?

Is their continuing failure to secure their system due to lack of will/lack of money/what they're using or some combo of the three?

Re:Since the article doesn't mention, I'll ask:

[andih8u]

Well, if you've ever contracted for the government, you'd know that trying to get anything done is close to impossible. Any step you take has to be combed through by several beurocrats who have no more interest in anything other than plodding through their days on the way to retirement. Even if you do manage to get all of the systems designed and get ready to roll the upgrades out, someone will just come along and axe the plan while they try to figure out if this move will make them risk their neck in the slightest.

Trying to work for people who essentially can't be fired is a nightmare.

Re:Since the article doesn't mention, I'll ask:

[Chester K]

Even if you do manage to get all of the systems designed and get ready to roll the upgrades out, someone will just come along and axe the plan while they try to figure out if this move will make them risk their neck in the slightest. Trying to work for people who essentially can't be fired is a nightmare.

The above is absolutely true, and during some contracting work with the military, I was even told pretty much exactly what's said above.

When it comes to Government IT, the only thing that can really get you fired is if you opened a new security vulnerability. The way the admins deal with that is by not allowing any changes to occur under their watch. It's extremely infuriating.

Re:Since the article doesn't mention, I'll ask:

[0x0d0a]

See, the problem was having 10 people involved in the initial decision-making.

Having *feedback* from lots of people is okay. Having more than three people involved in actually making a decision is, IMHO, a bad idea.

Looking Inward..

[ackthpt]

Dept of Interior can't get outside of itself.

Seems rather appropriate. What software are they running?

silly silly Jessica...

[wo1verin3]

In a recent visit with Gale Norton (Secretary of the Interior) the following happened:

Simpson, whose verbal gaffes are also legendary, pulled another one Sunday visiting the White House, our sources say. The singer was introduced to Interior Secretary Gale Norton and gushed: "You've done a nice job decorating the White House."

Source: washingtonpost.com

DOI understands Firewater instead of Firewalls

[James McP]

This is really sad. I first heard of the DOI's incredible mishandling of the Indian trust here on slashdot a few years ago when they were shut down the first time.

I can understand having problems recompiling literally centuries of data for tens of thousands of people. But c'mon, you can't figure out how to set up firewalls with VPN connections between disparate groups?

Could you imagine any private organization like a mutual fund or retirement investor leaving SSNs and customer information online on websites? Imagine the smack down from the government! But if it's the gov't itself nada. Thank god (or Great Spirit, whatever) that there's at least one judge willing to do the right thing.

Re:DOI understands Firewater instead of Firewalls

[SoSueMe]

They're really not shy about flaunting that ignorance either.

"We are working closely with the Department of Justice to quickly respond to this order in the appropriate legal venue," the agency said in a faxed statement.

How about quickly responding to the security order?

Priorities

[Rorschach1]

Obviously the Secretary of the Interior needs to spend less time decorating the White House.

The Internet eh?

[goosebane]

I think part of the problem with a lot of the corporations/departments having many security flaws, or systems open to the net that shouldnt be is the fact that many people still see the internet as an idealistic place for the exchange of ideas and commerce. People are still slow to realize the danger that lies in the internet, and the fact that it can be dangerous. If people knew more about the dangers of technology they might be more apt to work on protecting themselves.

As an Indian, I can say this

[tacokill]

That's cool. We'll just keep the casino money.

I'm Here To Help The Government

[SEWilco]

Oops.
I emailed the Department of the Interior, pointing out that they should consider selling any unsolicited copies of software so as to not waste the value of gifts. They shouldn't use gift material as that bypasses the intent of normal acquisition processes.

Now I know why I got no response...

ironically true

[drivers]

Coincidentally, The Dept of the Interior actually does decorate the White House.

Anonymous Coward...how insecure

[Anonymous Coward]

"its systems were too insecure to be left open"
Well, I feel sorry for the systems. It is really rough working for the government and having self esteem issues. If I worked for the gov't, I would be a little insecure my self : P

It's a political thing

[Anonymous Coward]

"The Interior Department said the order "is a new frontier in this court's efforts to run the operations of executive branch agencies."

"We are working closely with the Department of Justice to quickly respond to this order in the appropriate legal venue," the agency said in a faxed statement. //

It's a political thing. Probably not much of a technical problem here at all. Somebody's making a move for power somewhere and now all of this BS. They are punishing the Interior by taking down links with schools on them rather than just blocking traffic via access lists and firewalls.

If they really had a problem with some of the services being provided as insecure they could have either firewalled those services or just blocked them at the router. Since, they did not take a rational approach to solving the problem, the problem is likely a political one from one greybearded idiot to another.

Been a consultant for the government. Seen it. I once went almost 4 months doing nothing but earning good money while waiting for the Chicago Tollway to resolve some political infighting. 4 months of sitting at home, watching TV and basically chilling out on Illinois tax dollars.

It was lovely.

Re:Technology vs. Indians

[stoolpigeon]

Much of the money that is handled 'for' the native americans is not federal money from taxes. It is money that is due native americans through things like mineral rights. Security should not even be at the top of the list though- plain mismanagement and incompentence that is criminal. But as is often the case- none of the big players are being held responsible to the extent they should. You can read about it all over the place - like this article

2001?

[klipsch_gmx]

Looks like the Interior Department has been having computer problems for a long time (December 2001!):

"Web wanderers looking for information on national parks, government mapping services or geological disasters will need to get their information from non-official websites for a while.

U.S. District Judge Royce Lamberth issued the order late Wednesday after a report showed that the computer system which handles $500 million annually in royalties from Indian land has major security holes that make it easy to access the system, alter records and possibly divert funds."

Re:Technology vs. Indians

[El]

Uh, do you know what a "treaty" is? It is a legally binding contract. Despite having repeatedly violated the treaties, the Interior Department is legally bound to try to honor them. These "payments" are usually part of ongoing compensation for having deprived people of land that they were legally entitled to. The priciple of Eminent Domain does allow the government to kick people off their land, but stipulates that they must be compensated.

Re:Guess the Indians shot themselves in the foot .

[Tihstae]

Doesn't look like this will do anything positive for the Native Americans.

No, there is no way that protecting their privacy and keeping the money that is rightfully theirs from being stolen is doing anything good for them. Give me a break, read the article and not just the headline.

Oops, this is Slashdot. (Rosanne Roseannadana Voice) Nevermind!!

Arrgh...

[ehintz]

It's frustrating to be out of work and not getting offers, while knowing I'm considerably more competent than these fools who still seem to have jobs after b0rking it time and time again.

Re:Technology vs. Indians

[Wyatt Earp]

You don't really understand what happened do you?

Firstly, there is no Indian "race" or "nation" that was in conflict with the United States.

There were many conflicts with many tribes and there are many settlements which differ in scope and letter of the agreement.

Since the closing of the Frontier in 1890 and the end of major military action with the American Indians around the same time the rights of the American Indians have changed and the role of the government in thier lives has changed.

The crux of this arguement between the DOI/BIA and the folks suing them isn't about monetarily reimbursing for "or practically annahilating their race" it's about mismangement of natural resources on lands which are on Reservations or were on Reservations which are held in trust by the United States Government who act as stewards of the resources, both discovered and undiscovered.

Basicly the DOI/BIA has lost billions of dollars of money that should have been paid out to various tribes and various private citizens. Not only that, but they can't figure out a webserver that holds confidental information on the monies going out to private citizens that can't be exploited.

my step dad works for the Dept of Interior

[Squeezer]

and just so everyone knows, the dept of interior is 100% standardized on Microsoft Windows. They do not use any Unix/Linux/BSD anywhere. everything is windows. thats part of the problem of why they are so insecure

Re:my step dad works for the Dept of Interior

[SpaceLifeForm]

Dept. of Homeland Security, meet Dept. of Homeland In-Security.

Re:my step dad works for the Dept of Interior

[midol]

Netcraft shows:

NT4/Windows 98 Lotus-Domino/5.0.8 19-Jul-2001 198.183.146.15 U.S. Department of the Interior
NT4/Windows 98 Lotus-Domino/5.07 30-Jun-2001 198.183.146.15 U.S. Department of the Interior
NT4/Windows 98 Lotus-Domino/5.0.7 29-May-2001 198.183.146.15 U.S. Department of the Interior
NT4/Windows 98 Lotus-Domino/5.0.6 18-Feb-2001 198.183.146.15 U.S. Department of the Interior
NT4/Windows 98 Lotus-Domino/5.0.5 10-Jan-2001 198.183.146.15 U.S. Department of the Interior
unknown Lotus-Domino/5.0.5 8-Jan-2001 198.183.146.15 U.S. Department of the Interior
NT4/Windows 98 Lotus-Domino/5.0.5 1-Jan-2001 198.183.146.15 U.S. Department of the Interior
unknown Lotus-Domino/5.0.5 31-Dec-2000 198.183.146.15 U.S. Department of the Interior
NT4/Windows 98 Lotus-Domino/5.0.5 13-Nov-2000 198.183.146.15 U.S. Department of the Interior

Re:my step dad works for the Dept of Interior

[Vellmont]

Incorrect. I used to work for the US Geological Survey, and they used Data General unix systems about 10 years ago. I seriously doubt they've dropped all the unix machines as science has a strong history of using Unix. The Dept of Interior is also a huge department, so it'd be very difficult for them to have ONLY windows machines throughout the entire organization.

May It Please The Court...

[SEWilco]

• The US Department of the Interior web site is not responding.
• We Slashdot users are glad to assist in ensuring that DOI web servers can not function for the next 48 hours.
• The DOI is required to accept gifts from Indian Tribes under several circumstances. Are the DOI mail servers and web servers properly accepting gifts from tribe representatives?

  "(g) No Refusal Gift Acceptance Policy
  All Department of the Interior employees may accept gifts offered to them by representatives of Indian Tribes, Alaska Native Organizations, Insular and foreign governments when refusal to accept such gifts would be likely to cause offense or embarrassment or otherwise adversely affect relations with the United States."

• Are DOI machines accepting gifts from Indian Tribe servers which are equipped with generous worm programs?

Ironic

[1WingedAngel]

If irony was made of strawberries, we'd all be drinking a lot of smoothies right now.

article text

[Anonymous Coward]

Interior Dept unplugged from the Net

Judge orders agency to shut Internet system after concluding security holes are still a problem.
March 16, 2004: 2:46 PM EST

WASHINGTON (Reuters) - Wide swaths of the Interior Department were taken off the Internet again Tuesday after a federal judge concluded that the agency still has not fixed security holes that threaten payments owed to American Indians.

It was the third such shutdown for the Interior Department since 2001, when an investigator found that hackers could easily steal money from a system that allocates energy and mineral royalties to 300,000 Indians for use of their land.

U.S. District Court Judge Royce Lamberth said the system still remained vulnerable despite the department's assurances to the contrary, and the agency could not be trusted to fix the problem by itself.

"The feigned indignance of Interior aside, there is simply no other alternative. Interior brought this on themselves," Lamberth wrote in an opinion signed Monday.

The Interior Department said the order "is a new frontier in this court's efforts to run the operations of executive branch agencies."

"We are working closely with the Department of Justice to quickly respond to this order in the appropriate legal venue," the agency said in a faxed statement.

Lamberth, who serves in Washington, ordered Interior to pull all its computer systems offline except for those involved in vital police and fire services.

Bureaus that oversee national parks and provide geological information can also remain online as they have no relation to the trust data, he said.

Divisions that oversee wildlife management, oil and gas royalty payments and Indian affairs were offline Tuesday. Employees are unable to access the Web or send e-mail to those outside the agency, spokesman Dan DuBray said.

The order also shuts down a program that provides Internet access to schools on Indian reservations, the agency said.

Interior could bring its systems back online if an independent reviewer certified them as secure and monitored them on a monthly basis, Lamberth said.

The Interior Department consistently attracts failing computer-security grades from congressional reviewers.

The blackout stems from a class-action lawsuit between the agency and Indians who allege that it has mismanaged trust accounts set up in the late 19th century to handle proceeds from oil, gas and minerals extracted from Indian lands.

Lead plaintiff Elouise Cobell, a member of Montana's Blackfeet tribe, charges that the government has lost track of billions of dollars and wants the judge to transfer control of the accounts to a court-ordered receiver.

Working with a court-appointed overseer, the agency had been able to bring nearly all of its systems back online within a year after Lamberth ordered them unplugged in 2001. But Lamberth ordered some systems offline again in July 2003 after a dispute between the agency and the overseer.

Too busy picking wallpaper...

[NaugaHunter]

... to worry about security.

[Jessica] Simpson, whose verbal gaffes are also legendary, pulled another one Sunday visiting the White House, our sources say. The singer was introduced to Interior Secretary Gale Norton and gushed: "You've done a nice job decorating the White House.

(source, near the bottom, after W. refers to the Ford Theatre as the Lincoln Theatre.)

Not all of DOI is offline.

[BubbaFett]

It looks like the Park Service, USGS , and Office of Aircraft Services are still online. Yet there are some seemingly unrelated divisions offline that probably shouldn't be. I don't see why the National Interagency Fire Center is offline. It seems somewhat important!

Re:Technology vs. Indians

[osu-neko]

There's no reason we should still be paying penance for the actions of our ancestors. If my father went out and killed someone, I wouldn't get in any trouble for it, so why do natives still deserve the support we give them, and why do we still feel obligated to give it to them?

If your grandfather killed my grandfather, I wouldn't expect you to be punished for it. On the other hand, if your grandfather stole my grandfather's property, and I'm my grandfather's rightful heir, were this fact uncovered, you should be expected to give me back the property that is now rightfully mine. That's not punishing you for a crime your grandfather committed, that's not penance, that's just doing what's right.

Now, if we want to give the natives of North America back what rightfully is theirs, we European decendants need to get on ships and sail back to the Old Country, set up shop in London or whereever. Personally, I don't want to do it. So, if I'm not going to give back what is rightfully theirs, I should at least pay rent on it, no?

Again, I'm not interest in punishment, which I don't deserve, or penance, when I don't need. What I'm interested in is doing what's right...

What right does the court have?

[cheeser]

Why is the court telling the DOI to unplug? Is there a lawsuit I'm missing? The court's job is to rule on lawsuits brought before not define public policy or run about ordering people around. So unless there's a lawsuit about the DOI's systems, the court should stfu.

Funky People

[Anonymous Coward]

I'm posting this AC for obvious reasons.

A few years back we had a run-in with the DOI. We found very strange things in our web and FTP logs and traced them back to a Denver office of the DOI. Basically what they were doing was spending hours every night (way after office hours) digging and digging and digging to see what they could find. There were tons of 501s because these guys would enumerate when directory listing was turned off.

My colleage wrote to the DOI in Washington and asked 'what's up'. Because of the evidence we could show, the DOI Washington office decided to put a sniffer on the Denver line. Great, we thought, soon this wil be cleared up. As if.

A week goes by, and the Washington DOI people contact us. Their sniffer thing didn't work. When they were about to install it, some dork went around the Denver office barking, 'OK EVERYBODY HAS TO GO HOME EARLY TONIGHT WE'RE INSTALLING A SNIFFER ON THE LINE'.

Now if you believe that story (and that's how they told it) is another matter. We did not - and ever since, at regular intervals, they're back again.

Funky group. Very funky!

Re:Technology vs. Indians

[YetAnotherDave]

There's some irony in Wyatt Earp setting the record straight here :)

Culprit is...

[bonch]

...the sysadmins.

Linux was shown as the most-breached OS on the net according to that study Slashdot posted, remember.

Shred them, m'boy, shred them!

[Evil Schmoo]

Which is why secured government facilities are required to shred all classified documents. And as for Mr. Feynman's legendary escapades, Los Alamos was recently severely upbraided by the DOE for its lax security.

Most government facilities have the lowest level of classified information ("Secret"). Very few have "Top Secret" or higher. And even with Secret, there are very extensive procedures in place in terms of document storage, personnel access, etc.; you're not going to be able to get in with a penknife, leastways not when the document is in a 2-ton graphite safe with 70-point rotary dial behind an armed guard gate.

And as for the guy who found a 10-Base T hub? Dude. That's nothing. We throw old junk away all the time. I just threw 5 Betacam SP decks, worth about $6000 each, in the trash last week. Remember, the agencies can't sell equipment; only the GSA sells surplus, and that's at auction. And it's not like the agencies get credit for turning stuff in. So there is no financial incentive for the agencies to save old equipment, and the paperwork is far too much of a hassle to deal with, just to get it transferred off the books to surplus. (You have to verify condition and certify it, blah blah blah.) So we just get it written off as damaged beyond repair, and toss it.

Believe me, I'd take the stuff home if I could, but then I'd technically be stealing. It has to be officially thrown away first.

God Bless America.

Re:Shred them, m'boy, shred them!

[mr_sfstk8d]

Correction:
The lowest level of secure materials is FOUO, For Official Use Only. It only has to be torn into quarters (printed doc. that is). Secret must be shredded, and TS or higher (wink, wink) must be pulverized, incinerated or both.
Which is why in certain work places, they keep hatchets, sledgehammers and white phosphorous grenades handy. Spring cleaning, don't you know.

We can't pay because, uh....

[qtp]

The computers are down for uh... (maintenance? No we cant say that... used it in 1980...)

uh... (For updating to a new accounting system for this very account? Damn, used that in '92... there's got to be a good excuse here somewhere... I know!..)

Oh, yeah it's a security issue! That's it, a security issue... can't mess with security now, can we? Not after 9-11!...

(Good one!)

Yes, we'll get back to you about that $700,000,000.00 we owe you after all of this is sorted out...

Oh, sure. As soon as possible...

Don't worry about it, we've got everything under control. Thanks for being so understanding...

Oh yeah, I almost forgot, your access is going to be out for a while...

That's right, no email, no web...

Yes, there'll be no distance learning at the schools either for the time being...

Really, that's not fair. Why don't you people just hire more teachers? ..

What's that? ...

$700 Million? ...

It's funny how technical problems always plague the DOI every time this issue comes up.

A passing grade for security is not easy for Feds

[donheff]

I don't know anything about Interior's problems with the Indian accounting systems, but I can assure you that the security scorecards for Federal systems are tough. OMB and the Hill have appropriately set a very high bar to push agencies to the limit. The intent is to make government systems a model for security best practices - they don't get marked "green" unless they jump through a lot of hoops. There are plenty of bright people on /. who could teach the Feds and anyone else a lot about secure systems. But there are also a whole lot of us who, truth be known, are running critical systems that couldn't come close to passing muster against the standards used to rate the Feds on security.

I also haven't seen any specifics about why the Judge is hammering DOI. I wouldn't be surprised if they are simply battling with the Judge over the oversight processes she wants to impose - granted that might be a dumb battle to fight.

nope

[JeanBaptiste]

i write software for many many many banks in Minnesota.

Almost all of them use pgp for anything remotely confidential, and many use md5 checksums to make sure nothing got changed in-transit.

I dont know the prices myself but im pretty sure its not $10k. Even if it is, thats peanuts for most banks, especially for something as critical as that.

Plus, I have software out there that many companies dealing with credit cards use. If you apply for a Target credit card, your application (after it has been scanned) goes through my application. Guess what, coming into and going out of, its encrypted.

Maybe you havent worked with banks lately, I'll agree it was pretty bad maybe 6 years ago, but they have got up to speed quickly and most are more secure than your average large company.

I work for the DOI (USGS)

[ImTwoSlick]

The computer security can be laughable sometimes. Those of us who develop software, use Linux whenever possible. I NEVER boot my pc into windows except to allow the IT people to update my antivirus defs. You wouldn't believe the grief I get if I don't boot into windows at least once a week.

Department of Interior?

[mh101]

And what exactly is a "Department of Interior"? Please enlighten this curious non-American. This is the first time I've ever seen the name Department of Interior...

Re:Department of Interior?

[Warlok]

Department of the Interior, in charge of everything outdoors in the U.S. of A. Like Gallagher said, they picked the word that didn't fit.

The issue isn't copying information.

[Ungrounded Lightning]

First you have to gain access to the facility, then you have to have access to that area and then you have to have access to the files. It is not that easy to just stroll in there and get a copy of them.

At least in the case of the indian stuff it wasn't an issue of getting copies of the information.

They "lost" essentially all of the indians' money - and the records were corrupted enough that it was no longer possible to trace who took it.

The bureaucrats in charge (the likely suspects) then took advantage of the insecure network to finger-point away from themselves. And the systems were taken offline when it was shown that they were STILL wide open.

Tribal Colleges (bia.edu)

[mccoma]

All of the Tribal Colleges that were hooked to the BIA now have no internet access. Most of the colleges are in rural areas that have no other avenue for internet access (well, barring spending a lot of $$$ which most of these tribes don't have - casinos only work if you have a large city next door).

Any distance learning classes are going to have some problems. So the court ruling affects the education of the next generation. It looks like US Geological Survey (the group that administers the bia.edu part) will be going to court to get the order lifted for the colleges so they can go on without interference.

PS
Also, it is believed that the amount of lost money for mineral / grazing rights on the trust land total around $10 billion.

Here's basically what has happened

[Anonymous Coward]

Here's the breakdown of the judges' decree I read at work (at one of the DOI deparments) earlier today (and yes, internal email still works!)

A couple years ago Cobell wanted to know how much money was in the trust fund. DOI stutters, says "uhhhh" and a lawsuit is filed. DOJ (Department of Justice) says to DOI "Your computers are not secure, you're cut off from the internet until they are secure." Internet is out for a few months. An appeal is filed, DOI says "We've fixed the problem!" DOJ says OK. Internet is restored, but as it happens nothing has really been secured. IBM is hired to hack at the servers, and for a month and a half of hacking NO ONE NOTICED or even attempted to take countermeasures.

Here's a kicker: when a security audit was planned for one of the machines, DOI pulled the plug when they knew it would be getting scanned! Needless to say, the judge is rightfully upset with DOI, and we probably deserve to have our internet shut off.

In the meantime, it really sucks to have to order stuff over phone and fax. I just hope this outage doesn't last for months. Today was long enough.... :)

Cheers.